Most people expect something dramatic to happen. A warning, a popup, a message saying your computer has been compromised. Something that makes it obvious.
That is not how it works. Usually, nothing happens at all. The page loads, looks odd, maybe you get a 404 error, and you close the tab thinking you got away with it.
You did not get away with it.
Here is what is actually happening from the moment you click.
The link is not going where it says it is
A phishing link almost never points directly at the thing it is pretending to be. It usually goes through one or more redirects first. You click a link that looks like it goes to Microsoft, it bounces through a compromised website in another country, then lands on a page that looks like the Microsoft login screen but is hosted on a domain you have never heard of.
This matters for two reasons. First, it makes the original email harder to detect. The link in the email looks plausible, sometimes even using a legitimate URL shortener or a real service like Google Docs or OneDrive. Second, it gives the attacker flexibility. They can point the redirect at different final destinations depending on who clicks, when they click, and what device they are using.
The fake login page
If the goal is to steal your password, you will land on a page that looks exactly like the real thing. Microsoft, PayPal, your bank, your HR system, your email login. These pages are often near-perfect copies. The logo is right, the layout is right, the colours are right. The URL is wrong, but most people are not checking the URL.
You type in your email address and password. The page might then tell you the password was wrong and redirect you to the real site, so you log in there successfully and assume nothing happened. By that point your credentials have already been sent to the attacker.
This is why MFA matters. If the attacker has your username and password but not your second factor, they cannot get in. But this is also where it gets more complicated, because modern phishing attacks have a response to that.
The real-time relay attack
More sophisticated phishing operations do not just capture your credentials. They sit between you and the real site in real time. You type your password on the fake page, they immediately use it on the real page, the real page sends you an MFA code, you type that on the fake page, they immediately use it on the real page before it expires.
From your perspective you just logged in normally. From their perspective they now have an active authenticated session, and they copy that session token so they can continue using your account even after you close your browser.
Tools that do this are not rare. They are packaged, sold, and rented. You do not need to be a sophisticated attacker to use one.
The malware drop
Not all phishing links are after your password. Some are after your device.
Some links trigger a download the moment the page loads, without you clicking anything. Others use browser vulnerabilities to run code silently. The goal here is not to steal one password but to install something persistent: a keylogger that records everything you type, a remote access tool that gives the attacker control of your machine, or ransomware that sits quietly for weeks before activating.
The dormancy is deliberate. Ransomware operators often wait. They get in, they move quietly through the network, they identify the backups, they work out what data is most valuable, and only then do they encrypt everything and make their demand. By the time you see the ransom note, they have often been inside for weeks or months.
What happens after a credential theft
If the goal was your email password, the attacker does not immediately do anything obvious. They log in quietly and read. They are looking for useful information: pending invoices, supplier relationships, financial conversations, login credentials stored in old emails, HR data, anything they can use or sell.
Then they wait for an opportunity. A supplier invoice comes in. They intercept it, change the bank account details, and let it continue to you. You pay what you think is a legitimate invoice to what is actually the attacker’s account. By the time anyone notices, the money is gone.
Or they set up a forwarding rule that silently copies every email you receive to an external address. They log out, do nothing visible, and just read your emails for months. There is no indication in your inbox that anything has changed.
What to do if you have already clicked
If you clicked a link and you are not sure what happened, the time to act is now, not tomorrow.
Change the password for whatever account you think may have been targeted, and do it from a different device if you can. Check your email forwarding rules and inbox filters for anything you did not set up. If you entered credentials, tell your IT support immediately, because the priority is working out whether an active session exists that needs to be terminated. If you are on a managed device, it needs to be checked for anything that may have been installed.
Do not assume that because nothing looked wrong, nothing happened.
The uncomfortable truth
The reason phishing works is not that people are careless. It is that the attacks are well-made. The emails are convincing, the pages are convincing, and the window between clicking and realising something is wrong is often wide enough for everything to happen.
The defences that actually help are MFA on every account, particularly email; a process for verifying bank account changes by phone before paying invoices; and staff who know what to do when they are not sure about something, which means reporting it rather than hoping for the best.
If you want to know how exposed your business actually is, our free IT audit covers exactly this kind of risk.
