A user forwards you an email asking them to confirm their login details, and they've already clicked the link. What do you do?

What the interviewer is looking for

• This question tests security awareness. Responds quickly to phishing or suspicious activity, contains the risk and follows the incident process.
• Strong answers: Resets the password, ends active sessions, checks multi-factor, reports to security, looks for similar emails and reassures the user.
• Likely follow-up: How would you help other staff avoid the same email?

Another way it may be asked: Someone says they think they fell for a phishing email and entered their password. Walk me through your next steps.

A structure to follow: Answer, explain, example, limits

1. Step 1

   Answer

   Give your direct answer in the first sentence so the interviewer knows where you are going.

2. Step 2

   Explain

   Say how it works or why you would do it that way, in plain words before jargon.

3. Step 3

   Example

   Anchor it in something you have actually done or seen, with the detail that shows hands-on experience.

4. Step 4

   Limits

   Say when your approach would not be the right one. It shows judgement.

This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.

Common slips

• Reciting a definition without showing you have applied it.
• Using terms you cannot explain if asked a level deeper.
• Claiming experience beyond what you can discuss in detail.

How to practise it

Say the answer in 90 seconds, then answer the follow-up as if it were a new question.

Related questions

• A user says their computer is really slow. What steps would you go through to find out what's going on?
• A frustrated user calls saying they've lost an hour of work and need help right now. How do you handle the start of that call?
• Someone can't get on the internet, but the coworker sitting next to them can. What would you check?
• A user calls saying they're locked out and asks you to reset their password. How do you make sure it's really them?
• How would you set up a new laptop for an employee starting next week so it's ready on their first day?

Browse all questions