You have received a suspicious message and you are not sure what to do. Or perhaps you have already clicked. Either way, knowing what to do after a phishing attempt is just as important as spotting one in the first place.
This article covers exactly that: the right actions depending on your situation, and the official French channels to report what you have encountered. If you have not yet read our guide on how to recognise a phishing attempt, start with How to Spot Phishing Before It’s Too Late.
Phishing: What to Do When You Suspect a Message
No need to spend hours investigating. If a message seems suspect, three actions are sufficient, in this order.
First, do nothing on the message itself. Do not click, do not reply and do not call the number provided in the message. Even clicking “unsubscribe” can confirm that your address is active and therefore trigger further attempts.
Second, verify through a different channel. If you receive an email claiming to be from your bank or Ameli, open the official app directly or type the known address, such as ameli.fr, impots.gouv.fr or laposte.fr, into your browser. Never use the link in the suspicious message to check. Instead, contact the organisation through official channels found on their real website.
Third, talk to someone. At work, alert your IT team or manager even if you are not entirely sure. A false positive costs nothing. Personally, consult Cybermalveillance.gouv.fr, which offers a free online diagnosis and connects you with certified support professionals.
Some Figures About Phishing
90%
of all data breaches involved phishing.
Every 20 seconds
, a new phishing portal is registered and launched.
4%
of employees enter data on a fake website.
20%
of employees click on fake attachements.
9 out 10
phishing operations succeed.
12%
of employees click on a fake link.
What Really Happens After a Click: From Your Password to a Ransomware Attack
Most people assume a successful phishing attempt means one stolen password. That is often true. However, it can also be the beginning of a far more serious chain, especially if you use a personal device for work.
From One Click to Business Shutdown
You click the link
A malicious program silently downloads. No visible alert. Just a few seconds are enough.
The stealer steals everything
Passwords, session cookies, browsing history, screenshots. Undetectable by standard antivirus solutions.
Your data appears on the dark web
Sold on criminal marketplaces within hours. Corporate VPN access is among the most sought-after assets.
Intrusion into the company
Attackers connect using your legitimate credentials. Silent network observation. Lateral movement for weeks.
Ransomware deployed
Files encrypted, backups destroyed. Ransom demands range from €50,000 to several hundred thousand euros. Phishing is the initial access vector for more than 90% of ransomware attacks (ANSSI Cyber Threat Landscape 2023).
Complete business disruption
Days to weeks of operational downtime. Data loss. Customer impact. Long-term reputational damage.
The stealer: the software that empties your digital life in silence
Many phishing links do not lead to a fake login page. Instead, they trigger the download of an invisible programme called a stealer. Once installed, it runs silently in the background and systematically collects everything on your machine. It captures every password saved in your browser, whether Chrome, Firefox or Edge. It records your session cookies, which consequently allow the attacker to log into your accounts without even knowing your password. It also collects your complete browsing history, recently opened files and sometimes live screenshots of your desktop.
You see nothing. Your antivirus, in many cases, sees nothing either, because these tools are specifically designed to bypass standard detection methods.
Within hours: your data for sale on the dark web
The data collected by the stealer is automatically sent to a server controlled by the attacker, then sold on specialist criminal marketplaces. The price of a “log”, meaning the full dataset from one victim, ranges from a few euros to several hundred, depending on the value of the detected accounts. A professional VPN login, access to a company accounting tool or an Ameli account containing complete identity data can therefore each fetch a significant premium.
Criminal groups buy these datasets in bulk, sort them and subsequently exploit or resell them. Furthermore, your professional email address and VPN password can end up in dozens of different hands without you ever knowing.
If you use a personal device for work: your company is now exposed
This is the scenario that turns an individual incident into a collective crisis. You clicked on a personal laptop, the same one you use to connect to your company VPN, professional email and shared tools. The attacker consequently has legitimate access to your organisation’s information system, using your credentials and from your machine.
They will not act immediately. Instead, they will observe, map the network and identify backups, critical servers and the most valuable access points. For weeks, sometimes months, they therefore move quietly from system to system. Security experts call this lateral movement.
The ransomware: the moment everything stops
When the attacker has found what they are looking for, they trigger the ransomware. Within hours, every file in the organisation becomes unreadable, encrypted and inaccessible. Backups, if reachable from the network, are destroyed first. A message then appears on every screen demanding payment to recover the data.
For a small or mid-sized business, the consequences are often existential. Operations shut down completely for days or even weeks. Data loss can be irreversible if backups are insufficient. Reconstruction costs range from €50,000 to several hundred thousand euros. Clients are impacted through unfulfilled orders and blocked deliveries. Moreover, reputational damage can last for years, particularly if customer data was exfiltrated and published online.
All of this can consequently stem from a single click on a message that looked like it came from La Poste or Ameli.
This scenario is not hypothetical. It matches the operational pattern of the vast majority of ransomware attacks suffered by French SMEs. Indeed, phishing is the initial entry vector in more than 90% of cases according to ANSSI.
You Already Clicked: Not Everything Is Lost, However Act Fast
Many people only read this kind of article after they have already clicked. That is completely understandable. Here is therefore what to do depending on your situation.
You clicked but entered nothing
The risk is limited in most cases. Close the page immediately and do not reopen it. Run a virus scan if you have one available. Additionally, report the suspicious email or URL on Signal Spam so that the CNIL can identify the sender and take action.
You entered a password
Change it immediately on the affected service and on every other service where you use the same password. This is urgent because stolen credentials are tested against major platforms within minutes. Subsequently, enable two-factor authentication (2FA) everywhere it is available. Most French banking apps, Ameli and impots.gouv.fr all support it.
You shared bank details or a one-time SMS code
Call your bank immediately, not tomorrow but right now, using the number on the back of your card or on the official website. Request that your card be blocked and recent transactions frozen. Keep all evidence including screenshots, the original email and any SMS received, as you will need them for the police report and any potential reimbursement claim.
The reaction window is very short. For fraudulent bank transfers, banks have only a few hours at most to attempt a recall of the funds. Beyond that point, recovery chances drop sharply. Therefore do not wait.
How to Report Phishing: the Official French Channels
Reporting phishing, even when you have not been a victim, helps protect others. The platforms below are the official French channels to alert the relevant authorities.
Signal Spam is the main platform for reporting suspicious emails and fraudulent URLs. It is associated with the CNIL, which can consequently trigger investigations and sanction the senders. Reach it at signal-spam.fr.
33700 is the free service dedicated to fraudulent SMS or MMS messages. Simply forward the suspicious text to 33700 and the service will work to block the sender at scale.
Cybermalveillance.gouv.fr at cybermalveillance.gouv.fr provides a free online diagnosis and connects victims with certified support professionals. It is furthermore the main public reference for all phishing-related guidance in France.
If you have suffered financial loss or identity theft, you can file a police report online at thesee.interieur.gouv.fr or in person at your local commissariat or gendarmerie. You can additionally call the French Ministry of the Interior’s anti-fraud helpline at 0 805 805 817, which is free and available Monday to Friday from 9am to 6:30pm.
Signal Spam
The Most Important Thing to Remember
Phishing what to do is ultimately a simple question with a simple answer: slow down, verify through an official channel, and report what you have seen. The damage from a phishing attack rarely comes from the message itself. It comes from acting too fast, without checking.
Furthermore, if you manage a team, keep in mind that every employee is a potential entry point. A single click from a single person can consequently be enough to compromise your entire organisation’s information system. The most effective protection is therefore not a technical tool. It is a trained, aware team that knows how to react.
Not sure how to recognise a phishing message in the first place? Read our article How to Spot Phishing Before It’s Too Late.
Is your team ready to spot phishing in real conditions?
Stroople provides tailored training programs and real-world phishing simulations to assess your employees’ actual exposure level and embed the right security reflexes over the long term.