Clicked Something Dodgy? How to Report a Cyber Incident Fast

Clicked a dodgy link or paid a fake invoice? Learn how to report a cyber incident fast, the first 5 steps to take, and build your free “Who do I call?” card.

Cyber Security Action Month · Mission 4 of 4 · 26 October

Cyber Security Action Month 2026

Your four missions this October

One practical topic a week to help your team stay a step ahead of cyber criminals. Take a second. Stay secure.

Mission 015 Oct
The Spy Who Emailed Me
Phishing scams and fake invoices
Mission 0212 Oct
Is That Really Your Boss on the Phone?
AI and deepfake scams
Mission 0319 Oct
What Would a Criminal Pay for Your Client List?
Passwords and protecting data
Mission 0426 Oct
Clicked Something Dodgy? Here's What to Do Next
Reporting cyber incidents

At a glance

Core takeaway

If you click something dodgy, tell your IT provider straight away. Minutes matter.

What to know

Most damage happens when people stay quiet because they’re embarrassed.

Common risks

Deleting evidence, hiding mistakes and not knowing who to call.

Reality check

Anyone can click. A no-blame culture makes people report it fast.

How we help

Intellect IT helps you contain incidents, recover and build a response plan.

01 Quick answer – Report a cyber incident
02 What to know first
03 Your mission this week
04 Why speed matters
05 Why people stay quiet
06 Signs something’s wrong
07 Interactive incident
08 Your first 5 steps
09 Who to call and report to
10 Mission debrief: the month in review
11 How Intellect IT can help
12 Build your “Who do I call?” card
13 Frequently asked questions

QUICK ANSWER

The Practical Starting Point: What Should You Do If You Click Something Dodgy?

If you click a suspicious link, open a dodgy attachment or pay a fake invoice, report it straight away. Tell your IT provider first, call your bank if money was sent, don’t delete anything, and write down what happened.

Then report the cyber incident to ReportCyber at cyber.gov.au, or call the 24/7 Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). If your device may be compromised, use a different one to make the report.

It’s Monday morning and your inbox is full. An email from a supplier you know asks you to review a document. You click, sign in, and the page goes blank. Something feels off, but you’re busy and a bit embarrassed. So you close the tab and say nothing.

That silence is where most of the damage happens. While you’re hoping it was nothing, a criminal could be reading your email, setting up hidden rules or sending fake invoices to your clients from your account.

At Intellect IT, we’d always rather get the call. Every incident is different, so the message is simple: tell us quickly, and we’ll guide you from there. No blame, no judgement, just a fast response.

WHAT TO KNOW FIRST

Key takeaways

Report it straight away

The first hour matters most. Reporting quickly gives your IT provider the best chance to lock accounts, stop payments and limit what a criminal can reach.

Silence causes the damage

Clicking a link is rarely the disaster. Staying quiet is. Criminals rely on embarrassment to buy themselves time inside your systems.

Don't delete anything

Keep the email, the invoice and any messages. Deleting evidence makes it harder to work out what happened and who else was targeted.

Write down what happened

Jot down the time, what you clicked, what you entered and anything odd you noticed. A few notes save valuable time later.

Know who to call before you need to

Keep your IT provider, bank fraud line and ReportCyber (1300 292 371) somewhere everyone can find them. Build your free "Who do I call?" card below.

No blame, ever

Thank people who report mistakes. A team that speaks up fast is your strongest defence. Blame only teaches people to hide the next one.

Mission briefing · Week 4 of 4

Your mission: raise the alarm, fast

This October, Intellect IT has followed KnowBe4’s “Secret Agents” campaign for Cybersecurity Awareness Month. Each week has been a new mission, and each one has helped turn your team into a frontline defence against cybercrime.

Mission 4 is the final one: reporting incidents. Over the past three weeks, you’ve learned to spot phishing scams, stop deepfake calls and protect client data. But even the best agents slip up sometimes. This mission is about what happens next: speaking up straight away, so a small mistake never becomes a big breach.

Mission objectives

Raise the alarm: Report anything suspicious to your IT provider straight away, even if you’re not sure.
Protect the evidence: Don’t delete anything, and jot down what happened while it’s fresh.
Know your contacts: Make sure everyone knows who to call, and that they’ll never be blamed for calling.

Want to run this mission with your team? KnowBe4’s free Cybersecurity Awareness Month kit includes ready-made tabletop exercises that walk your leadership team through a real incident. As a KnowBe4 partner, we can help you run one. Ask us how →

Why speed matters when you report a cyber incident

When something goes wrong, the clock starts ticking. A criminal with your password can read your email, set up hidden forwarding rules, change bank details on invoices and try the same login on other systems. Every hour of silence gives them more time.

6 minAustralians reported a cybercrime about every six minutes in 2024–25, with more than 84,700 reports in total.Australian Signals Directorate

$56,600was the average self-reported cost of cybercrime per report for a small business, up 14% on the year before.ASD Annual Cyber Threat Report 2024–25

42,500+calls were answered by the Australian Cyber Security Hotline, about 116 a day. Help is a phone call away.Australian Signals Directorate

Money moves fast: If a payment went to a criminal’s account, your bank has the best chance of stopping or recalling it in the first few hours, not days later.
Accounts can be locked quickly: Your IT provider can reset passwords, sign out every session and remove hidden email rules within minutes of hearing about it.
Others can be warned: Criminals rarely target just one person. A quick report lets your team, and your clients, know what to watch for.
Legal clocks may start: If personal information may have been exposed, businesses covered by the Notifiable Data Breaches scheme must assess it quickly and notify the OAIC if serious harm is likely.

Why people stay quiet, and how to change it

Most people who click a dodgy link aren’t careless. They’re busy, the email looked genuine and criminals are very good at their jobs. But once they realise, many keep quiet because they’re embarrassed, worried about getting in trouble or hoping it was nothing.

That’s why a no-blame culture is one of the most effective security controls you can have. It costs nothing, and it turns every staff member into an early warning system.

Say it out loud: Tell your team, often, that they’ll never be in trouble for reporting a mistake, only for hiding one.
Thank people who report: When someone speaks up, thank them publicly. Others will follow.
Make reporting easy: One phone number, one email address or a report button in Outlook. No forms, no hoops.
Lead by example: When leaders admit their own near-misses, staff learn it’s safe to do the same.

Why it matters

“The incidents that hurt businesses the most are rarely the ones where someone clicked. They’re the ones where nobody told us for three days. If you call us in the first ten minutes, we can usually lock things down before any real damage is done. So please, call us. We’d much rather have a false alarm than a quiet one.”

Stephen Allan Intellect IT Owner and Director, Cybersecurity Expert

Signs something’s wrong

Not every incident is obvious. Report it straight away if you notice any of these:

Sign 01
You clicked a link or opened an attachment that felt off
Sign 02
You entered your password on an unexpected page
Sign 03
You paid an invoice that might have been fake
Sign 04
Your account is doing things you didn’t do
Sign 05
Your device is acting strangely

Something felt off: The email was unexpected, urgent or slightly wrong, and you clicked anyway. That’s enough reason to call.
You entered a password: A sign-in page appeared after clicking a link, especially one that went blank or showed an error afterwards.
You paid a possibly fake invoice: Bank details had changed, or the supplier says they never sent it.
Your account is acting strangely: Emails in your Sent folder you didn’t write, new inbox rules, MFA prompts you didn’t request or contacts asking about odd messages.
Your device is behaving oddly: Pop-ups, new programs, files you can’t open or a warning from your security software.

If you’re not sure, report it anyway. Your IT provider would much rather check a false alarm than clean up a real incident.

Interactive incident

You’ve clicked something dodgy. What happens next?

Choose your next move and see how the incident unfolds. Every choice changes the outcome, so try again to see where the other paths lead.

This is a quick awareness exercise based on a typical email compromise, not incident-response advice.

Scenario summary: after entering a password on a fake sign-in page, staying quiet or deleting the email lets the criminal stay in the mailbox and send fake invoices to clients. Reporting straight away and telling your IT provider exactly what happened contains the incident within minutes.

Report Tell your IT provider in minutes, not days. No blame.

Preserve Keep the email, invoice and messages. Write down what happened.

Recover Lock accounts, stop payments, warn others and learn from it.

Your first 5 steps after clicking something dodgy

Every incident is different, so the most important step is the first one: tell someone. Your IT provider will guide you from there. While you wait, these steps help:

Step 01
Tell your IT provider now
Step 02
Call your bank if money was sent
Step 03
Don't delete anything
Step 04
Write down what happened
Step 05
Disconnect if your device is acting strangely

Call your IT provider straight away, even if you're not sure
Call your bank's fraud line if a payment was made
Keep the email, attachment, invoice and any messages
Note the time, what you clicked and what you entered
Disconnect from Wi-Fi if your device is acting strangely, but leave it switched on
Warn your team so nobody else clicks

Don't

Keep quiet and hope it was nothing
Delete the email, files or messages
Reply to the sender or click the link again to "check"
Switch off or wipe your device before your IT provider looks at it
Pay a ransom or contact the criminal
Try to fix it yourself with tools from the internet

Who to call and where to report a cyber incident

Your IT provider should always be your first call. Then, depending on what happened, these are the right places to report a cyber incident in Australia:

Report from a safe device. If you think your computer, phone or office Wi-Fi has been compromised, don't use it to make your report or change passwords. Use a different device, such as a colleague's computer or your phone on mobile data, so the criminal can't see what you're doing.

Who	When to contact them	How
Your IT provider	Always, and first. For any suspicious click, login, attachment or device issue.	Intellect IT clients: 1300 799 165
Your bank	If money was sent, or bank details may have been changed.	Your bank's fraud or business line, straight away
ReportCyber (ASD)	To report cybercrime such as email compromise, ransomware or hacked accounts.	cyber.gov.au/report or the 24/7 hotline 1300 CYBER1 (1300 292 371)
Scamwatch	To report scams, including fake invoices, phishing and impersonation.	scamwatch.gov.au
IDCARE	If personal or identity information may have been stolen.	idcare.org or 1800 595 160
OAIC	If personal information was exposed and serious harm is likely, for businesses covered by the Privacy Act.	Notifiable Data Breaches scheme
eSafety Commissioner	If the incident involves online abuse, such as image-based abuse or threats posted online.	esafety.gov.au/report
Your cyber insurer	If you have cyber insurance. Many policies require prompt notification.	The claims number on your policy

Not sure which apply? That's normal. Call your IT provider, and they'll help you work out who else needs to know.

What to include when you report a cyber incident

Whether you're calling your IT provider or lodging a report with ReportCyber, having these details ready makes the process faster and more useful:

What happened: A short description, such as "clicked a link in a fake invoice and entered my Microsoft 365 password" or "files have been encrypted".
When it happened: The date and time you first noticed something was wrong, and when you clicked, opened or paid.
What's affected: Which devices, accounts, systems or types of data may have been accessed, including client information.
What you've already done: Any steps taken so far, such as changing a password, calling the bank or disconnecting a device.
The evidence: The original email, invoice, screenshots, transaction references and any messages from the criminal.

Some businesses have extra legal reporting obligations

Ransomware payments: Under the Cyber Security Act 2024, businesses with an annual turnover of $3 million or more, and critical infrastructure entities, must report any ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours.
Critical infrastructure: Responsible entities under the Security of Critical Infrastructure Act 2018 must notify the ASD within 12 hours of a cyber incident with a significant impact, or 72 hours for a relevant impact.
Personal information: Businesses covered by the Privacy Act must notify the OAIC and affected people of an eligible data breach likely to cause serious harm.

If any of these might apply to you, speak to your IT provider and legal adviser straight away.

Mission debrief: what we covered this Cyber Security Action Month

This post wraps up our four-part series. If you missed any, each mission takes about ten minutes and includes a hands-on interactive for your team.

Mission 01The Spy Who Emailed MeCheck bank detail changes by calling a number you already have. Mission 02Is That Really Your Boss on the Phone?Hang up, call back, use a code word and two approvals. Mission 03What Would a Criminal Pay for Your Client List?Passphrases, a password manager and MFA on every account. Mission 04Clicked Something Dodgy?Report it straight away, keep the evidence and never blame.

Security awareness isn't a one-month project. The businesses that stay safe keep the conversation going all year, with short regular training, simulated phishing tests and a team that knows it's safe to speak up.

OUR DELIVERY MODEL

How Intellect IT helps you prepare for and respond to cyber incidents

Phase 1 – Prepare your incident response plan

Write a simple plan: We create a short, practical plan that says who to call, who decides what and how to contact clients if needed.
Keep contacts handy: We help you build a contact list for your IT provider, bank, insurer and the right government services.
Check your insurance: We help you understand what your cyber insurance needs from you after an incident.

Phase 2 – Build a no-blame reporting culture

Train your team: We run KnowBe4 training so staff recognise incidents and know exactly how to report them.
Make reporting easy: We set up a report button in Outlook and one clear number to call.
Back people who speak up: We help leaders make it clear that reporting a mistake is always the right thing to do.

Phase 3 – Spot problems early

Watch for warning signs: We set up alerts for risky sign-ins, new inbox forwarding rules and unusual activity in Microsoft 365.
Protect devices: We make sure endpoint protection and updates are in place across your laptops and servers.
Test your defences: Regular phishing simulations show who might need a refresher before a real attack.

Phase 4 – Respond fast when it happens

Contain the incident: We reset passwords, sign out sessions, remove malicious rules and isolate affected devices.
Investigate what happened: We check sign-in logs and mailboxes to work out what was accessed and who else was targeted.
Guide your reporting: We help you work out whether to report to ReportCyber, Scamwatch, your insurer or the OAIC.

Phase 5 – Recover and learn

Get back to business: We restore systems and data from backups so you’re up and running quickly.
Close the gaps: We fix whatever let the incident happen, from MFA to email filtering.
Run a debrief: We review what worked and update your plan and training, without pointing fingers.

The goal isn’t to stop every click. It’s to make sure every click gets reported quickly, handled calmly and learned from, so one mistake never becomes a crisis.

Interactive tool

Build your “Who do I call?” desk card

Fill in your details, check the preview, then download the card. Print it for every desk, or save it to your team’s shared folder, so everyone knows exactly who to call.

Your business name

IT provider and phone

Internal contact and phone

Bank fraud line

Cyber insurer and claims number

Your details stay in your browser. Nothing is sent to us.

Who do I call?

Your business

Clicked something dodgy? Call straight away. No blame.

IT providerIntellect IT · 1300 799 165

Internal contact—

Bank fraud line—

Cyber insurer—

ReportCyber1300 292 371

IDCARE (identity theft)1800 595 160

Don’t delete anything · Write down what happened · Call your bank if money was sent

intellectit.com.au

Decision support

How ready is your business for a cyber incident?

Select the description closest to your current position.

There’s no incident plan, staff aren’t sure who to call and some may worry about getting in trouble for a mistake. Suspicious emails get deleted rather than reported. If something went wrong today, it could be days before anyone found out.

Fast answers

Quick answers about reporting cyber incidents

Tap a question for a short, practical answer.

Will I get in trouble for reporting that I clicked a link?

You shouldn’t. Most businesses, and every good IT provider, would much rather hear about a mistake straight away. Reporting quickly is what limits the damage. Hiding it is what makes incidents expensive.

Should I turn off my computer if I think it’s infected?

Not straight away. Disconnect it from Wi-Fi or unplug the network cable, but leave it switched on and call your IT provider. Turning it off can destroy evidence they need to investigate.

Is it worth reporting if no money was lost?

Yes. A compromised account can be used to scam your clients or steal data later. Reporting to your IT provider and ReportCyber helps contain it and helps warn others.

What if I’m not sure it was a scam?

Report it anyway. It takes your IT provider a few minutes to check. A false alarm costs nothing, but a missed incident can cost thousands.

Get Help With a Cyber Incident →

This article provides general cyber security information and isn’t legal, financial or incident-response advice. If you suspect a cyber incident, contact your IT provider and bank immediately. Our October series followed KnowBe4’s “Secret Agents” Cybersecurity Awareness Month campaign.

Need help with a cyber incident, or want to be ready for one?

At Intellect IT, we help Melbourne businesses respond quickly to cyber incidents, recover their systems and put a simple incident response plan in place, backed by KnowBe4 security awareness training. If someone in your team has clicked something dodgy, call us now on 1300 799 165. If you’re not sure your team would know who to call, or whether they’d feel safe speaking up, we can help you get ready. This Cyber Security Action Month, take a second to find out where you stand.

QUESTIONS, ANSWERED

Frequently asked questions

FAQs – How To Report A Cyber Incident

How do I report a cyber incident in Australia?

Tell your IT provider first, then report cybercrime to the Australian Signals Directorate through ReportCyber at cyber.gov.au or by calling the 24/7 Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).

Use a device that hasn’t been compromised. Report scams to Scamwatch, contact IDCARE on 1800 595 160 if identity information was stolen, and check whether you need to notify the OAIC.

What should I do if I clicked on a phishing link?

Tell your IT provider straight away, even if nothing seems wrong. If you entered a password, say so, so it can be reset and your account signed out everywhere. Don’t delete the email, write down what happened, and disconnect your device from the network if it starts behaving strangely.

What should I do if I paid a fake invoice?

Call your bank’s fraud line immediately and ask them to stop or recall the payment. Then tell your IT provider, keep the invoice and emails as evidence, and report it through ReportCyber and Scamwatch. Speed matters, because money can be moved on within hours.

Should I delete a suspicious email?

No. Keep it, and report it to your IT provider or use the report button in Outlook. Your IT provider needs the original email to investigate, block the sender and check whether anyone else received it.

Will I get in trouble for reporting a mistake at work?

In a business with a healthy security culture, no. Reporting quickly is what limits the damage. Hiding a mistake is what turns a small incident into a costly breach, so good employers thank people who speak up.

Do I need to report a cyber incident to the OAIC?

Only if your business is covered by the Privacy Act and personal information was exposed in a way likely to cause serious harm. That’s called an eligible data breach, and you must notify the OAIC and affected people. Your IT provider and legal adviser can help you assess it.

What is a no-blame security culture?

A no-blame culture means staff are encouraged and thanked for reporting mistakes and suspicious activity, rather than punished. It leads to faster reporting, which gives your IT provider the best chance of containing an incident before real damage is done.

Speak with an Intellect IT Expert Today →

Stephen Allan

Stephen Allan is an Owner and Director at Intellect Information Technology in Melbourne, specialising in Windows Server and Exchange management, Cisco communications, VoIP systems including Asterisk and Cisco Call Manager. With over 25 years of experience across diverse industries, he is known for his honest, straight-talking style and strong analytical skills that help clients clearly navigate complex technical challenges. He champions a customer-first philosophy, delivering clear, tailored IT infrastructure solutions grounded in best-fit, impartial advice.

Ready when you are

Ready to experience
IT that just works?

Talk to an IntellectIT specialist. No obligation, no sales pitch, just honest advice for your business.