What to do if you open a phishing email

Phishing attacks are on the rise. In fact, they’re up more than 60% in late 2022 compared to the previous year. Luckily, many email services have sophisticated filters to eliminate phishing messages before they reach you. But scams that make it through those filters are likely to be much more convincing, even if you know how to spot a phishing message. So, what happens when you open a phishing email, or worse, respond to one before you realize it’s a scam? Let’s explore ways to protect yourself and prevent phishers from reeling you in.

What happens if you open a phishing email?

Even if you’re an ace at spotting phishing messages, you may not recognize it’s a scam solely from the subject line. You may open the email before you realize something isn’t right. Fortunately, in most cases, nothing happens if you open a phishing email—as long as you don’t take the bait by clicking on anything or interacting with it further.

What should you do if you open a phishing email?

So, you opened an email and suspect it’s a scam. Luckily, your good instincts and a keen eye for spam kept you from clicking on anything. There are various ways to handle phishing emails. You should report the message to the following places:

• The government: Forward the email to the National Cybersecurity and Communications Integration Center (NCCIC) at . Bringing the issue to their attention lets the authorities investigate it further.
• The company the phisher claims to represent: Suppose you get a fake email from an online retailer. In that case, go to their website and look at their “Contact Us” or “Customer Service” options to find out how to report phishing attempts.
  • If the message appears to come from a known contact, a cybercriminal may have hacked their account. Be sure to inform them immediately using another means of communication, such as a phone call.
• Your company: If you received a suspicious message through a work email, others in the office may get similar messages. Follow your company’s procedures for reporting the email so they can investigate the threat and prevent others from becoming victims of phishing attacks.
• Your email provider: Most email services have methods of reporting a phishing attempt, often in a dropdown menu near the “reply” button. Doing this helps your email service refine its filters and prevent malicious messages from reaching you in the future. Reporting a phishing attempt to your provider could delete the message, so forward it to the NCCIC first.

Once you’ve reported the questionable message, mark it as junk and delete it if it’s still in your inbox. Also, delete it from your trash folder to ensure it’s completely gone.

What to do if you respond to a phishing email

While simply opening a phishing email won’t usually cause harm, responding to one or clicking on a link can have more serious consequences. In addition to reporting the message, you should:

• Change your passwords. Immediately change any passwords to prevent cybercriminals from gaining access to your accounts.
• Alert your financial institutions. If you gave out financial or credit card information, let your institutions know right away. They can advise you on the best course of action, including freezing the compromised cards or accounts to prevent fraudulent purchases.
• Some phishing scams install malware on your device when you click on or download attachments. If this occurs, disconnect the computer or mobile device from all internet connections until you can evaluate the issue. Taking the device offline will help to prevent the spread of viruses or other scams. If your device has been infected, learn how to remove malware.
• Alert your contacts. If a phisher gains access to your accounts, they may send more phishing messages as “you” to more effectively trick others into falling for a scam. Alert your contacts using an alternate means of communication so they can watch for suspicious messages that appear to come from you.
• Keep an eye out. If you’re the victim of a phishing attack, keep a close watch on your accounts and finances following the incident. Look for unusual purchases or account activity. Consider setting up two-factor authentication on your accounts to get alerts when someone tries to log in to your account from a new device.

The best way to avoid getting caught in a phishing scam is to avoid responding in the first place. However, understanding and implementing practical solutions to phishing attacks can limit the damage if you accidentally respond to a bogus message. Act quickly, and you may be able to prevent any repercussions.

Learn more about types of phishing and how to protect yourself from other online scams.