Phishing incident response: what to do when customers are hit

When a phishing campaign hits your brand, the first hours decide how much damage it does. A calm, rehearsed incident response beats improvisation every time. Here is a practical playbook for when customers are being targeted in your name.

1. Confirm and contain

Verify it is a genuine impersonation — the lookalike domain, the cloned page, the lure. Then contain: start the takedown immediately, and if the campaign harvests credentials, prepare to force resets for anyone who may have been caught. The goal of this phase is to stop the bleeding.

2. Evidence it

Capture the proof before it changes: dual-profile screenshots (defeating any cloaking), raw headers, the redirect chain and timestamps. Good evidence speeds the takedown and supports any follow-up with registrars, hosts or authorities.

3. Take it down

Resolve the clone's host, registrar and CDN and file evidence-backed reports to each, plus safe-browsing feeds to protect users immediately. Track until the page is confirmed offline.

4. Communicate

Once you understand the scope, tell customers plainly: what the scam looks like, what you will never ask them to do, and what to do if they already interacted. Clear, factual communication limits harm and protects trust far better than silence.

5. Review and harden

• Confirm removal and close the case with its evidence retained.
• Review what let the attack work and reach customers.
• Harden the gaps — email authentication, monitoring coverage, verification processes.
• Prepare for the next variant; campaigns rarely stop at one page.

The takeaway

A phishing incident is won or lost in the first hours. Confirm and contain, evidence it, take it down, communicate clearly, then review and harden. Have the playbook ready before you need it — and tooling that makes the fast steps fast.