A phishing mistake doesn’t have to become a financial disaster — but the first 30 minutes matter more than you think.