Phishing Incident Response Checklist Template

Owned by the on-duty security or service desk analyst.

• Acknowledge the reporter and record the time of the report — thank them, and ask them not to forward the email or click anything else
• Capture the original message as an attachment with full headers — a screenshot loses the routing and authentication data you need
• Analyse sender, headers, links and attachments — SPF, DKIM and DMARC results, lookalike domains, and URLs or files checked in a sandbox, never on a normal workstation
• Classify the message — credential phishing, business email compromise, malware delivery, spam or a simulated test; record a false positive and close if it is legitimate
• Ask the reporter what they did — opened, clicked, entered a password, opened an attachment, approved an MFA prompt or replied

Each answer in task 4 is a required Yes/No DropDown. Those answers decide whether Phases 3, 4 and 5 appear.

• Search mail logs for every copy — same sender, subject, URL or attachment hash; record how many recipients and which mailboxes
• Find who clicked or replied — URL click logs from the email filter, web proxy or DNS logs, and sent items; attach the list
• Purge the message from all mailboxes — for example Threat Explorer or a Purview search and purge in Microsoft 365, or the security investigation tool in Google Workspace where your edition includes it
• Record the scoping answers — credentials entered or MFA approved; payment or bank detail change requested; attachment opened or file run
• Block the sender, domain, URLs and file hashes — at the email gateway, web filter and endpoint tool; note any block that could affect a real supplier
• Warn staff if the campaign is still arriving — a short message describing the email, without links, and how to report copies

Appears only when Phase 2 records credentials entered or an MFA prompt approved. Assigned to the identity administrator.

• Reset the password and revoke all sessions and refresh tokens — Revoke sessions in Microsoft Entra ID, or reset sign-in cookies in the Google Admin console; a reset alone leaves stolen sessions working
• Review registered MFA methods and remove any the user does not recognise — attackers often add their own phone or authenticator app
• Check inbox rules, forwarding and mailbox delegates — rules that forward, delete or move mail to obscure folders are a classic sign of takeover
• Review OAuth app consents for the account — revoke any app the user did not knowingly grant access to mail or files
• Review sign-in and mailbox audit logs for the exposure window — locations, devices, mail items accessed and messages sent; attach the export
• Check whether the account sent phishing internally or to customers — and warn recipients if it did

Appears only when Phase 2 records a payment or bank detail change request. Tasks are assigned to the finance lead, not IT.

• Stop any pending payment and confirm whether money has already left — check the payment run, the amount, the date and the receiving account
• If money was sent, call your bank’s fraud team immediately and ask for a recall — recovery depends on the receiving bank freezing funds before they move on
• Report the fraud — the FBI’s IC3 in the US, Report Fraud (formerly Action Fraud) in England, Wales and Northern Ireland, or Police Scotland on 101
• Verify the request with the real supplier or executive on a known phone number — never the number or email in the suspicious message
• Check for other changed bank details and pending invoices from the same supplier — and tell the supplier, whose mailbox may be the compromised one

Appears only when Phase 2 records an attachment opened or a file run. Assigned to the endpoint team.

• Isolate the device from the network — through the endpoint tool where possible, leaving it powered on for investigation
• Collect the file and the endpoint tool’s findings — process tree, network connections and any persistence it created
• Hunt for the same file hash and indicators across other devices — and confirm the block in Phase 2 covers them
• Clean or reimage the device and reset any credentials used on it — based on what the investigation found

The escalation decision is an approval step for the security lead.

• Decide whether this is now a security incident — attacker activity beyond one mailbox or device, data accessed, or more than one account taken over
• Open the full incident response record where it is — and link this checklist so the timeline is not rebuilt from memory
• Start the data breach response checklist if mailboxes or files holding personal data were accessed — the regulator clock may already be running
• Notify the cyber insurer where a payment was lost or the policy requires notice — record the claim reference

Closure needs approval from the security lead.

• Give the reporter feedback — what the email was, what was done, and thanks; people who hear back keep reporting
• Report the phishing site or email to the authorities where useful — for example the UK NCSC’s Suspicious Email Reporting Service at report@phishing.gov.uk
• Feed the lesson into awareness training — the lure, the warning signs it carried and how it was spotted, for the next training cycle
• Tune filters and controls — new detection rules, lookalike domain blocks, external sender banners or phishing-resistant MFA for the targeted group
• Approve closure — scoping, purge, containment and any hand-over confirmed, with evidence attached