What a phishing response checklist should accomplish
A phishing incident can begin with a single email, text message, or login page and quickly become a credential theft, malware delivery, or business email compromise event.
A strong phishing response checklist helps security teams, IT staff, and employees act fast, preserve evidence, and reduce damage before attackers expand access.
This guide covers the full response lifecycle: detection, containment, investigation, remediation, and post-incident hardening.
It is designed to be practical enough for operational use while staying aligned with common frameworks such as NIST, CISA guidance, and modern incident response practices.
Why phishing incidents need a specific response plan
Phishing is not just an awareness issue.
It is often the first step in account takeover, financial fraud, data exfiltration, and ransomware deployment.
Attackers frequently use legitimate cloud services, short-lived domains, and convincing impersonation to bypass basic defenses.
A phishing-specific response plan matters because speed and sequence are critical.
The wrong order can allow an attacker to keep access, delete logs, forward mail, or pivot into additional systems.
- Credentials may be stolen and reused within minutes.
- Mailbox rules can hide replies and alerts.
- OAuth consent grants can create persistent access without a password.
- Compromised accounts may send internal phishing to employees and partners.
Initial triage: confirm the threat quickly
The first task is to determine whether the report is a nuisance, a malicious message, or an active compromise.
Start by collecting the original message and checking the sender, subject line, URLs, attachments, and reply behavior.
What to verify immediately
- Whether the message came from an external domain or a spoofed internal identity.
- Whether links resolve to a known phishing domain, URL shortener, or newly registered site.
- Whether the attachment type is dangerous, such as HTML, ISO, IMG, archive, macro-enabled Office files, or executable content.
- Whether anyone clicked, entered credentials, or approved an MFA prompt.
- Whether the sender account or mailbox appears compromised.
If the message references Microsoft 365, Google Workspace, Okta, Slack, or a payroll platform, treat it as high risk because those services are frequent targets for account takeover and fraud.
Containment steps for the phishing response checklist
Containment aims to stop the attack from spreading and reduce the attacker’s ability to persist.
These steps should be performed in parallel whenever possible.
Checklist for immediate containment
- Quarantine or remove the phishing email from all mailboxes using your email security platform.
- Block malicious domains, IP addresses, and sender addresses at the gateway and DNS layer.
- Reset passwords for any user who clicked and entered credentials.
- Revoke active sessions, refresh tokens, and connected app access for impacted accounts.
- Enforce MFA re-registration if phishing-resistant authentication was not already in place.
- Disable suspicious inbox rules, auto-forwarding, and delegated mailbox access.
- Isolate endpoints if an attachment was opened and there are signs of payload execution.
For business email compromise scenarios, also verify whether payment instructions, vendor banking details, or payroll changes were requested.
Finance teams should independently confirm any high-risk transaction by a trusted channel.
How to preserve evidence without slowing response
Good evidence handling helps determine scope, confirms the attack path, and supports legal or insurance needs.
Preserve the original email, full headers, URLs, screenshots, message IDs, and timestamps.
If the user opened a website or downloaded a file, capture browser history, endpoint telemetry, and file hashes.
Evidence to collect
- Original email in .eml or .msg format.
- Full message headers with authentication results such as SPF, DKIM, and DMARC.
- Any attachment samples and SHA-256 hashes.
- Proxy, DNS, EDR, and SIEM logs for the affected time window.
- Audit logs for mailbox access, password resets, MFA changes, and app consent grants.
Maintain chain of custody for artifacts that may be used in internal investigations, regulatory reporting, or law enforcement referrals.
Investigate the scope of impact
After containment, determine whether the incident was limited to a single click or involved broader compromise.
Start with the user, then expand to adjacent identities, endpoints, and cloud services.
Questions to answer during investigation
- Did the user only receive the message, or did they interact with it?
- Were credentials captured, reused, or validated by the attacker?
- Did the attacker create inbox rules, add forwarding addresses, or send follow-up phishing?
- Were sensitive files accessed from SharePoint, OneDrive, Google Drive, or other SaaS storage?
- Did the attacker attempt lateral movement, privilege escalation, or payment fraud?
Look for patterns such as repeated MFA prompts, impossible travel events, legacy protocol logins, and sign-ins from unfamiliar countries or autonomous systems.
In cloud environments, review OAuth applications and service principals because malicious consent can survive password resets.
Remediation actions after a phishing event
Remediation is the phase where you remove attacker access and close the paths that enabled the incident.
It should be tied to the specific attack vector rather than using a generic cleanup.
Core remediation tasks
- Change affected passwords and enforce MFA for impacted users.
- Revoke sessions, tokens, API keys, and app passwords.
- Remove unauthorized mailbox rules, forwarding settings, and delegates.
- Patch or remove malware if a malicious attachment executed.
- Reimage endpoints if the payload or persistence mechanism cannot be trusted.
- Restore any deleted or encrypted files from known-good backups.
- Update allowlists, sender policies, and conditional access rules based on the incident.
If the phishing attempt involved a fake login page for Microsoft, Google, Dropbox, DocuSign, or Adobe, search for other users who may have received the same lure.
Attackers commonly reuse infrastructure across multiple campaigns.
Communication and reporting responsibilities
Internal communication should be accurate, calm, and action-oriented.
Tell users what happened, what to watch for, and whether they need to reset credentials or ignore related emails.
Avoid sharing unnecessary technical details with nontechnical audiences.
Depending on the scope, you may also need to notify legal, compliance, HR, cyber insurance carriers, and potentially customers or regulators.
If financial fraud occurred, coordinate quickly with banking partners to attempt recall or fraud mitigation.
Who should be informed?
- Security operations and incident response teams.
- IT administrators for identity, endpoint, and email systems.
- Finance and payroll teams if payment diversion was possible.
- Legal and privacy teams if regulated data may be involved.
- Executives if the attack affected business operations or reputation.
How to improve detection for future phishing attempts
Once the incident is controlled, improve defenses so the same pattern is easier to spot next time.
Effective detection reduces dwell time and limits human decision-making under pressure.
Detection improvements to prioritize
- Enable robust DMARC, SPF, and DKIM monitoring for spoofing visibility.
- Use URL rewriting, detonation, and attachment sandboxing in email security tools.
- Alert on risky mailbox rule creation and external auto-forwarding.
- Monitor for suspicious OAuth consent and impossible-travel sign-ins.
- Track credential-stuffing indicators and repeated failed logins after a phishing wave.
- Centralize telemetry from email, identity, endpoint, and cloud platforms in a SIEM.
Organizations using Microsoft Defender for Office 365, Google Workspace security tools, Proofpoint, Mimecast, CrowdStrike, SentinelOne, or Splunk should tune detections around their highest-risk user groups and business processes.
Employee actions: a lightweight version of the checklist
Not every employee needs the full incident response playbook.
They do need a simple sequence that makes reporting fast and reduces harm.
- Do not click links or open attachments.
- Report the message to security or IT immediately.
- If you clicked, disconnect if instructed and stop using the device for sensitive work.
- If you entered credentials, change your password through the official portal right away.
- Approve no unexpected MFA prompts.
- Check for unusual email sent from your account.
Simple reporting habits are essential because phishing campaigns often succeed or fail based on how quickly the first user speaks up.
What to include in a reusable phishing response checklist
A reusable checklist should be short enough for real incidents and detailed enough to prevent missed steps.
Make it accessible to the service desk, SOC, and on-call administrators.
- Detection and triage criteria.
- Containment commands or platform-specific actions.
- Evidence collection fields and storage location.
- Identity reset and session revocation steps.
- Cloud application review steps.
- Endpoint isolation and malware handling instructions.
- Business notification and escalation contacts.
- Post-incident review and control-improvement tasks.
Review the checklist after every incident and simulation.
Phishing techniques change quickly, but a disciplined process keeps response consistent across email, SMS, collaboration tools, and impersonation attacks.