This article walks through what happens when an employee interacts with a phishing simulation, and what Paubox records at each step. It’s useful to review before you run your first campaign.
The simulated email
The email looks like the scenario you chose, such as a Microsoft password reset or a package delivery notice. With Mailbox Access connected, Paubox places it directly in the employee’s inbox, where it appears like any other message.
If they click a link
The link opens a sign-in page styled to match the scenario. The page asks for an email address and password. Paubox records that the employee clicked.
If they enter information and click Sign in
The employee sees a page titled “This was a simulated phishing test.” The page tells them:
- the email was a safe training simulation sent by your organization
- nothing was compromised, and nothing they typed was saved
- the specific warning signs they missed in that email, under “Here are the signs you missed”
- tips for spotting phishing next time, under “Before you click next time”
Note: Clicking a link alone doesn’t show this page. The employee sees it only after submitting the sign-in page.
What Paubox records
- whether the simulation was sent and opened
- whether the employee clicked a link
- whether they entered information on the sign-in page, and which fields they filled in (for example, email and password)
Paubox never stores, logs, or sends anywhere what an employee types on the sign-in page.
Good to know
- Links in a simulation don’t contain the employee’s name or email address.
- A click only counts when the link opens in a web browser, so automated link scanners don’t count as clicks.
- Reporting a simulation as phishing isn’t tracked in Security Awareness Training.