Receiving a suspicious email, clicking its link and observing unauthorized account activity are different events. Making that distinction in the first report helps responders prioritize correctly. The employee's role is to describe what happened accurately and involve the responsible team.
1. Verify the request through an independent channel
For urgent payment, sign-in or unexpected document requests, do not rely on the displayed sender name. Use a known contact method rather than the number or link inside the message. Avoid opening further attachments, revisiting the link or approving an unexpected authentication prompt. As CISA notes, polished language does not establish legitimacy; attackers can produce convincing, error-free messages.
- Validate the request through an existing supplier or company directory.
2. Record the interaction and time clearly
Report when the message arrived, the device used, the affected corporate account and the interaction that occurred. State separately whether information was entered, a file opened or an unexpected prompt approved. Do not include the password or verification code itself. Preserve the original message and headers under the organization's incident procedure, and avoid circulating suspicious attachments. Reach the responsible team through a trusted channel.
- Separate suspicions, confirmed facts and information still unknown.
3. Investigate the account and business impact together
An authorized administrator determines the response scope by examining sign-in records, mail rules, forwarding and unusual outbound messages. Account recovery decisions should consider existing sessions and connected applications. Involve the finance owner if payment instructions or bank details changed. Regaining access alone does not close the incident; assess affected files, recipients and follow-up monitoring under the organization's procedure.
- Identify the technical incident owner and the business contact.
Official technical sources
- CISA — Recognize and Report Phishing
- Microsoft Learn — Respond to a compromised cloud email account
- Microsoft Learn — Phishing investigation
This is general information. Version- and environment-specific work needs an authorised technical assessment.