Malte ZanderContents
- What does the 24-hour plan look like?
- Hour 0 to 1: How do you confirm the case and assign it?
- Hour 1 to 2: What evidence do you secure?
- Hour 2 to 4: Where do you report, and with what?
- Hour 2 to 6: How do you protect affected accounts?
- Hour 4 to 8: How do you inform customers and staff?
- Hour 8 to 24: What do you follow up on?
- What happens after the first 24 hours?
- FAQ
When a phishing site uses your name, the first 24 hours decide how many people it reaches. Confirm the case and name one owner within the first hour, secure evidence by hour two, report to host, registrar and browsers in parallel by hour four, and protect affected accounts at the same time. Then inform customers, follow up on every report and check whether data protection duties apply.
What does the 24-hour plan look like?
Six phases, partly running in parallel. The times are targets for a typical case, not legal deadlines.
| Time | Goal | Key actions | Owner |
|---|---|---|---|
| Hour 0 to 1 | Confirm and assign | Verify the report, rule out your own and partner sites, open a case, name one incident owner | Security |
| Hour 1 to 2 | Secure evidence | Full URL, screenshots, domain, DNS, hosting and certificate data, the source email or ad | Security |
| Hour 2 to 4 | Report in parallel | Host, registrar, CDN or DNS provider, Google Safe Browsing, Microsoft, national service | Security or brand protection |
| Hour 2 to 6 | Protect accounts | Block the domain in filters, check sign-ins, reset credentials and sessions | IT and identity team |
| Hour 4 to 8 | Inform people | Support script, website notice, targeted customer warning, internal heads-up | Communications and support |
| Hour 8 to 24 | Follow up and widen | Track replies, escalate, look for sibling domains, assess data protection duties | Incident owner, legal, data protection officer |
Hour 0 to 1: How do you confirm the case and assign it?
Confirm that the page impersonates you and is not yours. Many reports turn out to be a forgotten campaign site, a reseller or a partner.
Check the basics: domain, content, form target and whether your brand appears.
Rule out your own assets and those of partners and resellers.
Open one case with an ID, and record every action against it from now on.
Name one incident owner who decides and keeps the log. Everyone else knows whom to tell.
Hour 1 to 2: What evidence do you secure?
Everything a host, a registrar or a court would need, before anyone reacts. Pages often change or vanish once the first report arrives.
- Full URL with path and parameters
- Screenshots on desktop and mobile with address bar and time visible
- WHOIS or RDAP data, DNS records, IP address and hosting provider
- TLS certificate details
- The lure: the email with full headers, the ad, the QR code or the message
Our evidence guide explains each item and how to keep it credible.
Hour 2 to 4: Where do you report, and with what?
To every party that can act, at the same time. Waiting for one answer before the next report costs a day each time.
Hosting provider: in the EU, a notice under Article 16 DSA with reasons, the exact URL, your name and email and a good-faith statement (DSA).
Registrar: for generic domains, the abuse contact the registrar must publish. A screenshot and the complete URL count as useful evidence (ICANN).
CDN or DNS provider, if the site sits behind one.
Google Safe Browsing and Microsoft, so browsers warn visitors in the meantime.
National service, such as the consumer centers in Germany, antiphishing.ch in Switzerland or the NCSC in the UK.
Every channel with links is in How to report a phishing website in Europe.
Hour 2 to 6: How do you protect affected accounts?
Assume some people have already entered their credentials, and act on that assumption.
Block the phishing domain in your email gateway, web proxy and DNS filters.
Check sign-ins for unusual locations, ISPs and user agents, and for new inbox rules after a sign-in. Microsoft recommends exactly these hunts after proxy phishing (Microsoft).
Reset passwords and revoke sessions for accounts that show signs of compromise. With real-time proxies, stolen session cookies matter as much as passwords.
Watch payments and changes to bank details, because fraud can follow within minutes. In Microsoft's case, payment fraud began as little as five minutes after the theft (Microsoft).
Why one-time codes don't stop these attacks is explained in why two-factor login doesn't stop every phishing page.
Hour 4 to 8: How do you inform customers and staff?
Briefly, specifically and through channels you control. A good warning names the fake address, the real address and what you never ask for.
Support script: what the fake looks like, what customers should do, when to reset a password.
Notice on your website or login page if the campaign is broad.
Targeted message to people who were likely reached, without clickable links if possible.
Internal heads-up for sales, support and social media teams.
Our guide How to warn customers about a fake website without causing panic has wording and a template.
Hour 8 to 24: What do you follow up on?
The reports, the wider campaign and your legal duties.
Track every report: confirmation received, decision made, page offline. Resend or escalate where nothing happened.
Look for siblings: other domains on the same host, certificate or registrar. Campaigns rarely use one domain. See linking cases.
Assess data protection duties: if attackers accessed accounts in your systems, that can be a personal data breach. The controller must then notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, and document every breach (GDPR, Article 33). Involve your data protection officer. This is not legal advice.
Consider a criminal complaint where customers or your company lost money or data. The original messages serve as evidence (BayernPortal).
What happens after the first 24 hours?
The page may be gone, but the campaign often isn't. Keep checking the closed case, because copies return on new domains. See the resurfacing problem.
Hold a short review within a week: what took longest, which contacts were missing, which texts had to be written from scratch. Then turn the answers into templates.
Request a demo to see detection, evidence and parallel reporting in one workflow, or start the free fraud scan to see which lookalikes already exist.
FAQ
Who should own a phishing incident?
One named incident owner, usually in security or brand protection, with a deputy. The owner decides, keeps the log and is the single point of contact for support, communications and legal.
Do we have to notify the data protection authority?
Only if there is a personal data breach, for example when attackers used stolen credentials to access accounts in your systems. Then the notification is due without undue delay and, where feasible, within 72 hours. This is not legal advice.
Should we warn all customers?
Not always. Warn the people who were likely reached and add a general notice if the campaign is broad. A precise warning protects better than a vague one sent to everyone.
Should we file a police report?
Yes, when money or data was lost. The evidence package from hours 1 and 2 is what investigators need.
How do we know the fake site is really gone?
Check it from different networks and with the full link, including parameters. Some pages show the fake only to targets, so keep monitoring the case for a while.
Sources
ICANN advisory: DNS abuse obligations, 5 February 2024
Microsoft Security: AiTM phishing sites as entry point to financial fraud, 12 July 2022