Module 3 · 3.5

English

Nederlands English Deutsch Français

Clicked: what now?

Module 3: Recognising phishing · Reading time: 12 minutes

Learning objective: After this lesson you'll know what to do in the first hours after a click, a filled-in password, filled-in bank details or an opened attachment, in the right order, and how to report and forward phishing.
Key terms: containing the damage, changing your password from a clean device, revoking sessions, calling the bank, reporting, forwarding phishing (for example to the Fraud Helpdesk and the brand being impersonated)

It happens to everyone

Everyone clicks the wrong link at some point. Even people who've taken this course, even IT people. A good phishing email arrives at the wrong moment, with just the right story. Feeling embarrassed doesn't help, acting quickly does. The sooner you step in, the less an attacker can do with what they've got.

That's why the first step in any business is: report it immediately, to the colleague who handles IT or to your IT company. Agree that anyone who reports a click gets a thank you, not a telling-off (more on this in lesson 9.2). If someone's afraid of being blamed, they'll stay quiet, and then the attacker gets days to work with.

First work out: what exactly happened?

What you need to do depends on how far things went. Work that out first, briefly and honestly.

What happened	Risk	Key steps
Only clicked the link, closed the page	Low	Report, forward the message, stay alert
Filled in a password	High	Change the password, revoke sessions, check the account
Filled in a password AND a login code, or approved a notification	Very high	As above, immediately; the attacker may already be in
Filled in bank details or approved a payment	Very high	Call the bank immediately
Opened an attachment or download, or ran a program	High	Disconnect the device from the network, call in IT
Gave someone remote access	Very high	Disconnect, take the device off the network, IT and bank

Just clicking usually isn't serious: modern browsers are well protected. But a click can also trigger a download. If you're not sure, treat it as the more serious situation.

Step by step in the first hours

1. Report within your business. Immediately, even if you're not sure. Describe what you saw, when, and what you filled in or opened. Keep the message: don't delete it, you'll need it to report the incident.

2. Contain it. Did you open an attachment or give someone access? Take the device off the network: turn off wifi, unplug the network cable. Don't switch it off straight away, because what's in memory can help with the investigation (lesson 8.3). Don't keep working on that device.

3. Call the bank if money's involved. If you filled in bank details or approved a payment, call your bank immediately, using the number on your card or the official website. The faster you act, the greater the chance a payment can be stopped or reversed. A payment to a fake IBAN after invoice fraud should also be reported to your bank straight away.

4. Change your password from a clean device. Change the password of the account you entered. Do this on a different device than the one you opened the attachment on, because a program there might be watching. Type the address yourself or use your bookmark, not the link from the message. If you used the same password anywhere else, change it there too (lesson 2.1).

5. Revoke sessions and check the account. A new password doesn't always automatically kick out an attacker who's already inside. So log out of all other sessions (lesson 2.5) and check what they might have changed:

two-factor authentication: is there an unfamiliar app or phone number listed?
recovery details: has the recovery email address or phone number been changed?
forwarding rules and filters in your mailbox: an attacker likes to set up a rule that forwards all mail, or just mail containing "invoice", to their own address, or deletes it straight away. That way they keep reading your mail even after you've changed your password;
sent items: were any emails sent that you didn't write? If so, you need to warn your contacts.

6. Report and forward. See below.

7. Check whether it's a data breach. Could the attacker get into a mailbox, a customer database or another environment with personal data? Then there may be a data breach. Under GDPR, you must report a data breach without undue delay and, where feasible, within 72 hours of discovery, to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), unless it's unlikely to pose a risk to the people involved. Always record it in your data breach register. You'll learn how to assess this in lesson 8.2.

Reporting and forwarding phishing

Reporting is worthwhile, even if nothing happened. It helps get a fake site taken down faster, and warns others.

To the Fraud Helpdesk. The Fraud Helpdesk (Fraudehelpdesk) accepts fake emails with suspicious links or attachments at valse-email@fraudehelpdesk.nl. According to the Fraud Helpdesk:

preferably forward the email as an attachment. If you forward it normally, the technical data (the headers from lesson 3.3) gets lost. If that's not possible, for example on a phone, just forward it normally;
if the email appears to come from a bank or another well-known company, add that company's address in cc. The Fraud Helpdesk has a list of such addresses on its website;
texts, WhatsApp messages and other messages shouldn't be sent to that address; report them instead via the reporting form on fraudehelpdesk.nl. You also use that form for a suspicious email without links or attachments, and for helpdesk fraud over the phone.

In many email programs, forwarding as an attachment is called "Forward as attachment" or something similar.

To the brand being impersonated. If the name of a bank, carrier or supplier is being misused, let that organisation know through a channel you look up yourself on their genuine website, not via the message. Many organisations have their own reporting address for phishing. If it concerns your own hosting company or email provider, send it there too; with WebOké you can do this with a ticket, with the email as an attachment (Knowledge Base 581).

Reporting to the police. If you've lost money, or there's been misuse or an attempt at it, report it to the police. The Fraud Helpdesk gives advice and collects reports, but can't investigate itself. Only the police can do that.

After that, you can delete the message and block the sender.

Checking again after a week

An attack isn't always over after a day. Set a reminder for a week later:

Are there new login notifications or unfamiliar sessions?
Are there unfamiliar payments on the bank statements?
Are there new forwarding rules or filters in the mailbox?
Are customers or suppliers complaining about strange emails from you? Your mailbox may still be being misused to send spam (Knowledge Base 25).
What can we learn? Was the message easy to recognise, and what would help spot it sooner next time?

In practice: what it looks like

Monday, 9:12am. Fatima from Bakkerij Example enters her email password on a fake login page for "the accounting software". At 9:15 she notices the address was boekhoudpakket.inlog-check.example. She reports it to Kees, who handles IT. At 9:20, Kees changes the password to her mailbox from his own laptop and logs out of all sessions. In the webmail, he finds a new rule: all mail containing "invoice" is sent to an unknown address and then deleted. He removes the rule, turns on two-factor authentication, and checks the sent items: nothing was sent. Fatima forwards the phishing email as an attachment to the Fraud Helpdesk. Kees logs it in the incident log and checks whether the attacker could have seen any personal data. After a week, he checks the rules and sessions again.

Where these rules and sessions are found varies by environment. With WebOké, forwards for an address are shown in My WebOké and in DirectAdmin (Forwarders), and a rule can also be set up in the webmail or in the email program itself. With other providers it works similarly: look for forwarding, forwarders, rules or filters.

Summary

Everyone clicks the wrong thing sometimes. Report it immediately, without shame, and agree that reporting is rewarded.
First work out what happened: just a click, a password, a code, bank details, an attachment or remote access.
Order of steps: report, contain (off the network), call the bank if money's involved, change the password from a clean device, revoke sessions and check the account (especially forwarding rules), report and forward, assess whether it's a data breach.
Forward fake emails as an attachment to valse-email@fraudehelpdesk.nl, with the impersonated brand in cc; report texts and chat messages via the reporting form. If there's been a loss: report it to the police.
Check again after a week.

Quiz

Exercise

Exercise A3.5: The steps checklist after a click. You'll be given a situation and a stack of cards with steps. Choose which steps are needed and put them in the right order. The program checks your answer and explains why a step needs to come earlier or later.

Cookies at WebOké

Cookie settings

Necessary

Marketing