If you realize you've clicked a malicious link or entered your password on a fake site, the first steps are to change that password immediately (from a different, trusted device if possible), enable multi-factor authentication if it wasn't already on, and run a malware scan on the affected device. If financial information was involved, contact your bank immediately to flag potential fraud and monitor statements closely for unauthorized transactions. At work, report the incident to IT or your manager right away, even if you feel embarrassed — early reporting dramatically limits the damage an attacker can do, while delayed reporting gives them more time to move through connected systems. After the immediate response, continue monitoring your accounts for weeks afterward, since some attackers wait before using stolen information to avoid detection.