What to do when something looks off.
A 12–15 minute lesson: the operator's three cables (own verification, report, emergency), the post-click manual in order, and a real shift to practice it.
The safe-response protocol: verify through your own channel, report and isolate, and the exact steps to take if you already clicked.
The case
“Don't click” isn't a plan. The operator has protocol: verify on their own line, report to close the path, and emergency steps for when it already happened.
In 12–15 minutes you'll build your switchboard: three cables for every situation, the post-click manual in order, and a real shift to serve.
What you will learn
- Verify on your channel: never the message's route
- Report and isolate: protect the next ones
- Run the post-click protocol in the right order
The operator's shift
Stop → find your own line → patch. And if you already clicked: close, change, warn, report — in that order.
Verify
Your line, not the message's.
Report
Each report protects the next.
Emergency
The post-click manual, in order.
Shift
Four lines at once.
Frequently asked questions
What do I do if I already gave my password on a fake page?
In order: don't interact further, close the page, change the password from your own channel and revoke active sessions, warn the real service, and report. Order matters: first close the door, then fit the new lock.
Where do I report phishing?
Your own email's report button (Gmail, Outlook have it) is the first and most powerful one: it feeds everyone's filters. And if it affects a specific service, warn them through their official channel.
Test yourself: Lightning test: which cable do you take?
What does “verify through your own channel” mean?
Correct answer: Using the channel YOU choose: the app you open, the number you had, the site you type.
You pick the channel or the attacker did: there's no third option. Replying confirms you exist; the message's link is their territory.
You clicked, and on the “bank's” page you already typed username and password. First move?
Correct answer: Close the page NOW (don't continue), then change the password and revoke sessions.
Changing the key without closing the attacker's session is changing the lock with the burglar inside. First close, then renew, then warn.
Does reporting phishing help at all if “nobody reads it”?
Correct answer: Yes: every report poisons the domain's reputation and feeds the filters for everyone.
Silence leaves the next ones alone. Reporting is a collective patch: your ticket trains the filters that protect others.
The pocket rule — Never the channel the message brings: stop, find yours, patch. And if you already clicked: close, change, warn, report — order is what saves you.
What you take away
Know what to do about a suspicious message — and what to do if you already clicked: not just avoid.