Direct answer
Record the actual interaction and promptly involve the appropriate security or service provider. A click, credential submission and downloaded program present different questions; avoid assuming that all clicks have the same effect.
Establish a timeline
Ask when the message arrived, which device was used, whether a page loaded and what the user entered or downloaded. Use the original message and existing logs where authorized rather than opening the link again.
Do not ask the user to repeat the action for a screenshot. Preserve the report and avoid sharing passwords, one-time codes or sensitive URL parameters in the incident ticket.
Reference: NIST SP 800-61 Rev. 3: Incident response recommendations.
Separate the possible exposures
If credentials were submitted, use a trusted channel to change the affected password and any reused passwords, then follow the provider's account recovery guidance. If a payment card was entered, contact the issuer. If software was downloaded or run, the device owner and security team need to assess the device.
Reference: FTC: What to do if you were scammed.
Coordinate response and evidence
A work account may require the security team to review active sessions, recovery settings and sign-in activity. Record actions and their times; avoid deleting evidence or performing changes that conflict with incident procedures.
- Identify the affected account and device without recording a password.
- Note if a multifactor prompt was approved or a code was shared.
- Record whether a download was merely saved or executed.
Communicate uncertainty
A local link check can show structural clues but cannot establish what the page delivered or whether an account was accessed. Responders may need account, email or endpoint logs and the provider's assistance. Document checks that could not be completed.
Assessment limits
The appropriate containment depends on the interaction, device and account. A benign-looking link or a lack of immediate symptoms cannot prove an incident did not occur.
Frequently asked questions
Does one click prove an account was taken over?
No. Determine what happened after the click and review relevant account and device evidence with the appropriate owner.
Should I revisit the page to understand it?
Avoid repeating the interaction. Give the original message and your account of events to authorized responders.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.