Credential Compromise Response Checklist

When phishing captures a password, the clock starts. In a Google and UC San Diego study that planted decoy credentials on real phishing pages, 20% of the decoy accounts were accessed in less than 30 minutes and 50% within 7 hours (Bursztein et al., “Handcrafted Fraud and Extortion,” IMC 2014). That research predates today’s adversary-in-the-middle phishing kits, which relay the login, and often the session cookie, to the attacker in real time. Assume you have minutes, not days.

This checklist covers the immediate, short-term and longer-term actions when credentials are confirmed or suspected to be compromised. For the wider incident process, see our corporate incident response plan.

Immediate Actions (Start Right Away)

Begin these as soon as compromise is suspected, not when it is confirmed. Waiting for certainty gives the attacker time.

1. Disable or Lock the Compromised Account

Disable or suspend the account in your identity provider (Microsoft Entra ID, on-premises Active Directory, Okta, Google Workspace)
Do not rely on a password reset alone: the attacker may already hold a valid session, tokens or another way in
If the account cannot be disabled immediately, sign it out of all sessions and block sign-in

2. Revoke Active Sessions and Tokens

Revoke refresh tokens and active sessions. In Microsoft Entra ID, Microsoft’s emergency guidance is to disable the user and revoke their refresh tokens (for example with Revoke-MgUserSignInSession), and to disable the user’s registered devices if needed (Microsoft Learn)
Remember that already-issued access tokens can stay valid until they expire; Microsoft notes they last one hour by default, which is why it is extending continuous access evaluation to invalidate them in near real time
In Google Workspace, resetting a user’s sign-in cookies signs them out of browsers and mobile devices, and suspending the user does this automatically, but Google notes it does not sign the user out of apps such as Gmail and Google Drive for desktop (Google Workspace Admin Help); also review the user’s app passwords and connected apps
Invalidate API keys, personal access tokens and any service-account credentials the user controls

3. Check for Persistence Mechanisms

Attackers commonly set these up soon after getting in, so that they keep access after a password change:

Email forwarding rules: new rules forwarding mail to external addresses
Inbox rules: rules that move, delete or mark messages as read, often used to hide replies about a fraudulent payment
OAuth app grants: new third-party application consents
Delegated access: new mailbox delegation or shared access
MFA registration: new authenticator apps, phone numbers or security keys added to the account
Recovery details and connected accounts: changed recovery email or phone, linked accounts and social logins

4. Preserve Evidence

Before changes overwrite it:

Export sign-in and audit logs for the account, and check how long your platform retains them
Record or screenshot attacker-created rules, apps and settings before removing them
Build a timeline: when the phishing email arrived, when credentials were entered, when the compromise was detected
See our phishing forensics guide for detailed evidence handling

Short-Term Actions (First 24 Hours)

5. Reset Credentials Securely

Reset the password through a verified channel, not email, which may be compromised
Verify the user’s identity out of band (in person or by calling a number on file) before restoring access; a voice or video call alone is not proof of identity when both can be faked
Remove any MFA methods the attacker registered, then require enrollment of phishing-resistant MFA (FIDO2 security keys or passkeys) before restoring access. CISA calls phishing-resistant MFA “the gold standard” (CISA)
Reset passwords for any other accounts where the user reused the compromised password

6. Assess the Scope of Access

Work out what the attacker could reach with the account:

Email: search the mailbox for financial records, credentials and personal data, and check what was read or exported
Cloud storage: review recent file access, sharing and downloads (OneDrive, SharePoint, Google Drive)
Internal applications: check access logs for line-of-business systems reached through single sign-on
VPN and remote access: look for connections from unusual locations or at unusual times
Privileged access: if the account had admin rights, assume broader compromise and escalate

7. Check for Lateral Movement and Fraud

Search authentication logs for the account being used to reach other systems
Look for internal phishing sent from the account to colleagues
Check whether the attacker used the account to reset other accounts’ passwords
Review BEC indicators: was the account used to request payments or change bank details? If money moved, call the bank immediately to request a recall and file at ic3.gov. The FBI’s Recovery Asset Team helped freeze $679 million of $1.16 billion in attempted theft across 3,900 incidents in 2025, and the FBI stresses that “time is of the essence” (IC3 2025 report)

8. Notify Affected Parties

Tell the user whose credentials were compromised, with clear instructions and no blame
Notify people who received email from the account during the attack window
Warn external contacts if the account sent phishing or fraudulent requests
Involve management and legal counsel if sensitive data may have been exposed, since breach-notification deadlines may apply

9. Block Attacker Infrastructure

Block the phishing URL and domain at the web proxy and DNS filter
Block attacker IP addresses where that is useful, knowing they change often
Add the phishing email’s sender, subject and URLs to gateway block lists
Report the phishing site so it can be taken down; see our reporting guide

Longer-Term Actions (First Week)

10. Organizational Credential Sweep

If the campaign targeted several employees, assume more than one compromise:

Reset credentials for every user who received the lure and may have interacted, not only confirmed victims
Review sign-in logs across the organization for anomalies tied to the campaign
Check breach-notification services for your domain: Have I Been Pwned offers a domain search for domains you own, showing which of your addresses appear in known data breaches, and threat intelligence feeds can flag leaked credentials

11. Strengthen Technical Controls

Based on what happened, implement or tighten:

DMARC/SPF/DKIM if the phishing spoofed your domain
Email filtering rules to catch similar lures
Conditional access policies that require compliant devices and block risky sign-ins
Zero trust controls that limit what any single account can reach

12. Conduct a Lessons-Learned Review

Following your incident response plan:

Document the full timeline
Identify which detection and prevention controls failed
Measure time to detect and time to contain
Update awareness training to cover the technique used
File reports with IC3, the FTC or CISA as appropriate

Personal Account Compromise Checklist

For individuals whose personal accounts (banking, email, social media) were compromised through phishing:

Change the password immediately from a device you trust, and change it anywhere you reused it
Sign out of all other sessions using the account’s security settings
Turn on MFA, preferably passkeys or a security key
Check recovery settings and remove any email address or phone number the attacker added
Review recent activity, forwarding rules and connected apps
Check financial accounts for unauthorized transactions, and call your bank immediately if you see any
Place a fraud alert with one of the three credit bureaus (Equifax, Experian, TransUnion) if personal information was exposed; that bureau must notify the other two
Report to IC3 at ic3.gov if you lost money
Report identity theft to the FTC at IdentityTheft.gov for a recovery plan
Keep monitoring your accounts and credit reports for several months for delayed misuse

Key Takeaways

Move fast: in research, a fifth of phished accounts were accessed within 30 minutes, and modern kits work in real time
Disable the account and revoke sessions and tokens; a password reset alone may not evict the attacker
Hunt for persistence (forwarding rules, inbox rules, OAuth apps, new MFA methods) before declaring the incident contained
Scope assessment decides whether the incident stays contained or needs escalation
Remove attacker-added MFA and move the account to phishing-resistant MFA before restoring access
If money moved, call the bank and file with IC3 immediately

For the complete phishing defense framework, see our phishing recognition and reporting guide.

Sources

This content is for educational purposes only. Organizations should adapt this checklist to their specific environment, identity infrastructure, and regulatory requirements.