Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Tell IT or security immediately, preserve the original message, and explain exactly what happened after the click. A click alone does not prove that credentials were stolen or malware ran. The response depends on whether the employee entered a password, approved an app permission, downloaded or opened a file, or saw suspicious activity afterward. The same response principles apply to AI-generated and other phishing messages: investigate the interaction and any resulting exposure.
What the employee should do first
- Report the incident through the company’s established channel. Include the message and approximate time. Say whether a page opened, credentials were entered, an app permission was approved, or a file was downloaded or opened. Report it even if the page closed or nothing obvious happened. Microsoft advises work and school users who think they may have been phished to notify IT, and its phishing investigation playbook tells responders to establish what recipients did.
- Preserve the original message. Use the organization’s reporting tool if one is available; do not revisit the link or casually forward the message. Microsoft describes Outlook’s phishing-report action as a way to report and remove a message and improve filtering. See Microsoft’s user guidance.
- If a password was entered, identify the account to IT. Follow the employer’s password-reset and account-recovery process. Microsoft also advises changing affected passwords and passwords reused elsewhere, and enabling multifactor authentication. IT should investigate sign-ins and consider revoking sessions or tokens as appropriate.
- If an app permission was approved, say so explicitly. Consent phishing can grant persistent API access through an app token. The FBI Internet Crime Complaint Center’s September 2026 advisory warns that changing a password alone may not remediate this kind of access.
- If a file was downloaded or opened, report that and follow IT’s device instructions. Responders may need to investigate endpoint activity and isolate or remediate the device. The FTC’s small-business phishing guidance recommends disconnecting devices infected with malware and following response procedures.
How the response changes with the interaction
| What happened | Response emphasis |
|---|---|
| Clicked, with no known password entry, app approval, or download | Report the message and have responders verify the interaction and check for later account or device activity. A click alone does not establish compromise. |
| Entered a password | Tell IT which account was involved; follow recovery steps, change affected and reused passwords, and investigate sign-ins and sessions. |
| Approved an app permission or consent prompt | Tell IT explicitly so it can investigate and revoke unauthorized app grants or tokens as appropriate. A password reset alone may leave app-token access in place. |
| Downloaded or opened a file, or saw suspicious execution | Notify IT and follow device instructions; investigate endpoint activity and isolate or remediate the device if indicated. |
These distinctions follow Microsoft’s playbook and the FBI IC3’s warning about consent-phishing tokens.
As an Amazon Associate I earn from qualifying purchases.
What IT and security should investigate
Responders should follow the organization’s incident plan and scale actions to the evidence and business impact. Microsoft’s phishing investigation playbook outlines a practical sequence:
DriversOutdated Drivers Are Slowing You DownPerformancePC Slower Than It Used to Be?DriversCrashes, No Sound, or Screen Glitches?
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
- Identify the original message and its Message-ID; use mail trace or equivalent records to establish delivery, recipients, and routing.
- Look for other recipients and campaign variants. Determine who opened the message, clicked, opened an attachment, or submitted credentials.
- Correlate the report with identity sign-in and audit logs and endpoint activity.
- Where credentials or permissions may have been exposed, investigate suspicious sign-ins, password attacks, OAuth consent grants, token abuse, and unusual mailbox or collaboration activity.
- Based on findings, remove malicious messages from mailboxes; secure impacted accounts; revoke active sessions or tokens as appropriate; block malicious senders, domains, or URLs; and isolate or remediate affected endpoints.
- During recovery, review mailbox rules and forwarding settings, verify appropriate credential resets and multifactor authentication, improve relevant filtering and anti-phishing policies, and update detections and the response playbook.
These are possible investigation and containment actions, not a checklist that every incident requires in full. Microsoft’s incident response overview says plans should address incidents according to business risk and impact and be tested regularly.
#1 Best Overall
Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When to report outside the organization
Start with the employer’s incident-response channel. Whether to report externally depends on the facts and jurisdiction; an employee click does not automatically require an external report. The FTC’s small-business guidance lists reporting phishing attempts to the FTC and Anti-Phishing Working Group. For the consent-phishing cases described in its advisory, the FBI IC3 recommends reporting to IC3 or a local FBI field office.
Quick Recap
Bestseller No. 1
Bestseller No. 3
Best Value
Swissbit iShield Key 2 FIDO2 USB-C Security Key with NFC – FIDO Certified, Passwordless Authentication, Passkey & U2F, Phishing-Resistant Security for Enterprise
- SECURITY KEY FOR ENTERPRISE ACCESS: Supports FIDO2 passkeys and U2F for secure authentication across enterprise IT systems.
- PHISHING-RESISTANT AUTHENTICATION: Enables passwordless login with secure on-device credential storage and PIN-based user verification.
- COMPATIBLE WITH ENTERPRISE SYSTEMS: Works with FIDO2, WebAuthn, and U2F across enterprise, cloud, and modern IT environments.
- DRIVERLESS FIDO2 AUTHENTICATION: FIDO2 works natively with modern browsers and platforms. No drivers required.
- USB AND NFC CONNECTIVITY: Supports authentication via USB-C and NFC. No batteries required.
Rank #4
Thales - SafeNet eToken FIDO - FIDO2 Certified Security Key - Passwordless Phishing-Resistant Authentication for Web Apps, Devices & Desktops - USB-C - Pack of 1
- FIDO2 SECURITY KEY: A versatile, tamper-evident USB-C authentication device with sensitive presence detection for online security. FIDO 2.0 level 1 and U2F certified
- PASSWORDLESS CONVENIENCE: Replace frustrating passwords with a simple 4-digit PIN for accessing apps and sites. Seamlessly login to web apps and Windows sessions
- BROAD COMPATIBILITY: Works with Windows, Mac, Linux, Apple, iOS, iPhone, Android and USB-C devices. Seamlessly integrates with Identity Providers or Credential Management Systems supporting FIDO2, including Thales, Microsoft, AWS, and Google
- ENHANCED USER ADOPTION: Features a sensitive presence detector on the USB key, providing ease of use and superior security. Certified for U2F and FIDO2, ideal for individuals who want to secure access to their personal online accounts - Microsoft, Google, Twitter, Facebook, GitHub
- THALES: We offer a wide range of FIDO authenticators, providing robust, phishing-resistant MFA that comply with stringent regulations. With almost three decades of experience, Thales is a pioneer in passwordless authentication devices, supported globally by the FIDO Alliance and industry analysts
Rank #3
FEITIAN K40 USB Security Key - Two Factor Authenticator - USB-C with NFC, FIDO2 - Help Prevent Account Takeovers
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Rank #2
FEITIAN K9 USB A NFC - Two Factor Authenticator (2FA) - Multi-Factor Authentication (MFA) - Device Security Key + FIDO2 - Achieve Advanced Account Protection
- FIDO2 + FIDO U2F certified and supported USB security key
- Secured by NXP semiconductors
- Works in every browser and application without installing any drivers
- Supports desktops, laptops, tablets via USB-A and/or NFC, and supports iOS/Android Phones via NFC
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
