I clicked a phishing link and entered my password: what should I do now?

Change the password immediately from another device and have every active session and every token issued to applications revoked, because a new password on its own does not evict someone who is already in. Then check the mailbox forwarding rules, the authentication methods registered on the account and the authorized third-party apps: those are the three places where access survives a password change. Report it anyway, even if you think you have fixed it, because the value of a report is the minute it arrives.

Does phishing awareness training actually work?

It works, but not at driving clicks to zero: a well-built campaign fools attentive, informed people too, so a program judged on its click rate is measuring the wrong thing. The indicator that matters is the time between the click and the report, because that decides whether the episode stays a manageable alert or becomes an incident discovered two weeks later. Which has an uncomfortable consequence: a simulation used to blame whoever failed makes that very indicator worse, because it teaches people to keep quiet.

What is phishing?

Deception that pushes a person into handing over credentials, data or money by faking a legitimate sender.

Phishing is the technique by which an attacker convinces a person to hand over credentials, data or money while posing as someone they actually deal with, usually by email but increasingly by text message, phone call, workplace chat or paid advertising. It is not a matter of the victim being naive: today's campaigns faithfully reproduce the login pages of cloud services, are sent from genuinely compromised mailboxes belonging to known suppliers, and rest the request on a believable operational pretext, an invoice about to expire or a document shared by the boss. According to the ENISA Threat Landscape 2025, phishing is the initial access vector in 60% of incidents recorded in the European Union between July 2024 and June 2025, ahead of vulnerability exploitation at 21.3%. It is therefore the busiest entry point to everything else, from ransomware to payment fraud.

See also: Phishing-resistant MFA · Phishing-resistant MFA binds the second factor cryptographically to the service domain: passkeys and FIDO2 do that, SMS, TOTP and push do not.

The variants that really matter

The mass campaign, sent to thousands of addresses with generic wording, is the least dangerous and the one filters catch best. The serious damage comes from spear phishing, tailored to a specific person after studying their role, their suppliers and their calendar, often starting from public information or from data leaked in an earlier breach. Alongside email there is smishing over text messages, vishing over the phone, and quishing, a QR code printed on a fake bank notice, which moves the link to a personal phone where corporate controls do not reach. The fastest growing variant aims straight at the wallet: a request to change bank details sent from a supplier's compromised mailbox, that is, a case of business email compromise.

Why multi-factor authentication does not close the problem

Turning on multi-factor authentication sharply reduces the value of a stolen password, and it is the first thing to do, but it does not close the risk. Current phishing kits work as a reverse proxy: they place an intermediate page between the victim and the real service, relay the second-factor code in real time, and keep the already authenticated session cookie. From that point the attacker gets in without holding either the password or the phone, because the session is reused. This is why CISA guidance on phishing-resistant MFA sets domain-bound factors as the target, meaning passkeys and FIDO2 hardware keys, which by construction cannot be handed to a decoy site. Mind what they do not close, though, because that is the part people discover afterwards: the benefit is canceled if a weak recovery method stays enabled on the same account, an SMS or a secret question, because the attacker will use that instead of the passkey; and they cover neither session cookie theft from an already authenticated device nor consent granted absent-mindedly to a third-party application, which gains lasting access without going through any login at all. Whoever turns on passkeys and leaves SMS recovery standing has changed the lock and left the window open.

Why it matters for decision makers

Phishing should be treated as a process problem, not as a matter of individual awareness. Three moves are worth more than any training course: passkeys or hardware keys on the identities that matter, a written rule requiring verification on a different channel for every change of bank details, and an internal channel where a suspicion can be reported in thirty seconds without fear of embarrassment. Fast reporting is what turns a click into a manageable alert instead of an incident discovered two weeks later, and it rests on an incident response plan that is already written.