What staff see

Before any tests

• Welcome email. When you add someone on the Staff page, one at a time or from a CSV file, they get a Welcome to OutPhish email. It explains that they’ll get simulated phishing emails and has a Start Your Training button. See Add staff.
• Scheduling email. When you switch scheduled tests on or off, every active staff member gets a System Status Update email. It says phishing simulations are now active (or paused). See Schedule tests.

The test email

A test looks like an ordinary email. Nothing in it says it’s a test.

• The sender’s name and address are made up to look believable. They might look like a well-known service, your own IT or HR team, or another business.
• The email contains a link, a QR code or an attached PDF. See Test formats.

If they click the link or scan the code

They see a fake sign-in page. It looks like a Microsoft or Google sign-in page, depending on your Email platform setting on the Campaigns page. The click is recorded as soon as the page opens.

What happens next depends on what they do:

• They type something and press Sign in (Microsoft-style page) or Next (Google-style page). They’re taken to a page headed “This was a learning exercise”. It tells them this was a simulated phishing test from their organisation and that there’s no need to worry. This is recorded as Compromised in your reports.
• They don’t sign in. They stay on the fake sign-in page. They find out it was a test from the feedback email (see below).

Test links stop working after 14 days. If someone opens an older link, they see the learning-exercise page with the message “This phishing simulation link has expired.” Nothing is recorded.

Is what they type stored?

No. The fake sign-in page doesn’t send anything typed into it to OutPhish. When the button is pressed, the page tells OutPhish only that it was pressed, then moves to the learning-exercise page. No email address, password or other typed text is sent or stored.

The feedback email

About a minute after a click or sign-in, the staff member gets a Phishing Test Feedback email headed “Time for a Quick Training Refresh”. It:

• reassures them that it wasn’t a real attack
• shows the test email they received
• lists clues they could have spotted in that email, under Clues You Can Spot Next Time
• gives quick tips for next time
• has a Complete Your Training button.

Their training is marked as not done until they finish it. See Staff training.

At the same time, everyone in your account with the Organization Admin or Campaign Manager role gets an Employee Phishing Test Result email. It shows the person’s name, the time and what they did: Link Clicked or Credentials Submitted.

Staff don’t see their difficulty level. A click lowers it by 5, and signing in drops it to 0. See How tests work.

If they don’t click

Nothing happens. The test shows as Ignored or Opened in your reports. If scheduling is on, they get another test in the next round. See Read your reports.

Reporting a suspicious email

OutPhish doesn’t record when a staff member reports a test email. There’s no report button for staff, and reports don’t show it. If you want staff to report suspicious emails to you or your IT provider, tell them how.

If an IT provider runs OutPhish for you

Your staff see your provider’s name instead of OutPhish’s on the learning-exercise page and in the emails they get: the welcome email, the scheduling email, the feedback email, training reminders and certificates. The learning-exercise page says “Provided by” your provider, with “Powered by OutPhish”. See How MSP accounts work.