What staff should do after a suspicious email or login

Make reporting easy and immediate

When a staff member sees a suspicious message or unexpected login prompt, the first useful action is to stop interacting and report it through a known channel. If they have already clicked, entered credentials, approved a prompt or opened a file, they should say so promptly. A culture that punishes honest reporting can turn a small incident into a longer, harder investigation.

Use a contact method staff can find without relying solely on the affected email account. Publish the internal IT contact and an alternative for urgent incidents. Australian government cyber resources provide small-business guidance; use them alongside instructions specific to your systems. This guide is preparation advice and does not replace incident response from a competent professional.

Separate observation from confirmed compromise

Record what happened and when: message received, link clicked, information entered, prompt approved or payment changed. Preserve the message and relevant screenshots through your support person's approved process. Do not forward suspicious attachments widely or ask staff to reopen them to demonstrate the problem.

A suspicious email does not prove the device or account is compromised. Conversely, closing the browser does not prove everything is safe. Tell the responder the facts, including which device and service were involved. Let the support person decide the containment steps. If active harmful activity is occurring, follow the business's urgent response procedure rather than waiting for an ordinary ticket queue.

Protect payments through a separate channel

If a message requests new bank details or an unusual payment, pause the transaction. Verify using a previously established contact method, such as a known number from your own records. Do not use the phone number supplied in the suspicious message as the only verification. Require approval appropriate to the amount and business process.

If money may already have been sent incorrectly, contact the bank promptly through a trusted channel and tell the incident lead. Record transaction details and times. Do not assume a later email confirming the payment is genuine. Keep financial response, technical response and required reporting coordinated so that one team does not accidentally undo another's containment work.

Contain and recover with support

For suspected account compromise, the responder may need to secure credentials, review active sessions, check MFA and recovery settings, inspect forwarding rules and identify affected data. The correct sequence depends on the service and incident. A password change alone may not address persistent access or malicious configuration.

For a potentially affected device, obtain specific advice before reconnecting, resetting or wiping it. Destructive action can remove evidence or leave other affected systems untreated. Restore services from a trusted state and check for continuing access. The Australian government's Business Continuity in a Box resources can help with interim critical functions when normal systems are disrupted, but they still require an appropriate plan and capable implementation.

Communicate carefully

Assign one incident coordinator and a decision-maker. Keep a simple timeline of observations, actions and approvals. Use a separate trusted communication route if email integrity is uncertain. Tell staff what they need to do without speculating about blame or announcing unconfirmed conclusions.

Assess customer, insurer, legal, privacy and reporting obligations with appropriate advisers. Requirements depend on the circumstances; this article cannot determine whether a notification is required. Avoid promising customers that no information was affected before the investigation supports that statement. Record what is known, what is uncertain and when an update will follow.

Keep a practical decision record

Keep the response card short enough to find during a stressful call: stop interacting, use the trusted reporting channel, describe what happened and follow the responder's instructions. Include the payment escalation contact separately from ordinary technical help. Practise with the owner as well as staff, because authority and urgency are often part of a deceptive request. After an exercise or real incident, change the process that failed rather than merely telling everyone to be more careful. Clear verification steps are more actionable than a general instruction to remain vigilant.

Practise before an incident

Run a short discussion exercise: a staff member enters a password into a false page, a supplier asks for new bank details, or an administrator receives an unexplained MFA request. Ask who is contacted, how payments are paused and how staff work if email is unavailable. Fix missing contact details and unclear authority immediately.

Use the account security checklist to track preparation and the continuity guide to plan essential work. Do not judge staff only by whether they spot every message. Fast reporting, verified payment changes and a workable response process are practical controls when a deceptive message gets through.