Pause before acting on an unusual email, even if it appears to come from your hosting provider, bank or a colleague. This guide helps you describe the situation and choose first steps without improvising changes to your computer or accounts.
Recognize warning signs
Watch for manufactured urgency, an unexpected attachment, a sender address resembling the usual domain or a request for sensitive information. Do not reply or use the unsubscribe link in a suspicious message. Polished writing does not establish authenticity. These signs appear in CISA’s phishing prevention guide.
Check through a separate channel
Open the service from your usual bookmark or contact the person through a channel you already know. A link, lookalike domain or QR code can lead to an imitation. The Canadian Centre for Cyber Security explains these techniques.
For a request concerning Nuagerie, find our contact details on the support page. You do not need to sign in to the client area to reach us.
Report what happened
Notify your organization’s IT contact if a work account or device is involved. Do not circulate the message to colleagues. The Canadian Centre for Cyber Security recommends internal reporting and following the team’s instructions.
Prepare the subject, displayed sender, time, affected service and actions already taken. Be specific: message only received, link opened, file downloaded or run, password entered, or sign-in request approved. Do not provide passwords or verification codes. Ask how to supply the original message and useful evidence without publishing screenshots containing personal information.
If your email service offers a reporting function, use the one your organization has designated. Microsoft explains reporting in Outlook; the location varies by version. Reporting through the application does not replace notifying your IT contact when you have interacted with the message.
If you clicked or shared a secret
Stop interacting with the page. If you ran a file, installed software or executed a command, stop using the device and reach your IT contact another way. Follow their instructions; do not delete files or reset the computer on your own initiative.
If you entered a password, promptly change it from a trusted device using the service’s real address. Change it on any other accounts where it was reused. Report any unusual sign-in approval. Microsoft also recommends checking multi-factor authentication (MFA) and notifying the affected organization in its advice after a phishing attack.
A password change does not necessarily complete the investigation. The administrator may need to review sessions, authentication methods and email forwarding rules, as outlined in Microsoft’s compromised-account guidance. Leave those checks to the person responsible for the service.
Get relevant help
For a Nuagerie service, prepare a support request and explain the impact on your work. A click alone cannot establish that everything is compromised or that everything is unaffected: the next steps depend on what actually happened.