Home / Commons / Phishing drill kit

Toolkit

Practise spotting scams, without the blame.

Everything for a fair, consent-based phishing exercise: the ground rules, six watermarked training examples with their warning signs, a staff briefing script and a debrief sheet.

FreeNo sign-upNothing leaves your browserPrints the briefing and debrief

Ground rules

Fair, announced, and never personal.

An exercise that embarrasses people teaches them to hide mistakes. The UK National Cyber Security Centre warns that simulations can erode trust and create legal risk, and suggests alternatives, such as asking staff to write their own phishing emails in a friendly competition.

If you do run one, these six rules keep it fair. Many organizations will learn more from the training examples and the briefing alone.

  1. Get sign-off first

    A named leader approves the exercise in writing, and HR (or whoever handles staff matters) agrees how results will be used. The UK NCSC advises checking with HR before any phishing simulation.

  2. Tell staff it may happen

    Announce a window, such as “some time in the next month”, and explain why. You lose a little surprise and gain a lot of trust.

  3. Never shame or punish

    No names in reports, no league tables, no consequences for clicking. People who fear blame stop reporting, and reports are what protect you.

  4. Measure reports, not just clicks

    The number that matters is how many people reported the message, and how quickly. One fast report can stop a real attack.

  5. Never collect real passwords

    If anyone clicks, they see a friendly page that says this was a training exercise and how to spot the signs. Nothing they type is kept.

  6. Use no real brands or people

    Do not impersonate real companies, partners, funders or colleagues. Use made-up senders. Avoid cruel lures: pay rises, bonuses, health scares, job losses or family emergencies.

Training examples

Six scams, and how to spot them.

Show these in a team meeting or print them for a noticeboard. Every sender is made up, every address uses a reserved example domain, and none imitates a real company. They are pictures for discussion, not emails to send.

Training example09:12
From
File Share <no-reply@files-share.example>
Subject
A document has been shared with you

Hello,

A colleague has shared “Q3 budget revisions FINAL.xlsx” with you. This link expires in 24 hours.

Open document
Example 01A document has been shared with you
  • Unexpected share from an unnamed “colleague”
  • Urgency: the link “expires”
  • The sender’s domain is not one your organization uses
  • Check: open your file storage directly instead of the link
Training example11:40
From
Accounts Team <accounts@supplier-billing.example>
Subject
Updated bank details for invoice payment

Dear Finance,

Please note we have changed banks. All future payments, including the attached invoice, should go to the new account below. Please update your records today.

Example 02Updated bank details for invoice payment
  • A change of bank details by email
  • Pressure to act “today”
  • The callback rule: phone the supplier on a number you already had
  • More in the payment fraud toolkit
Training example14:03
From
IT Helpdesk <helpdesk@mail-support.example>
Subject
Your mailbox is 98% full

Your mailbox has almost reached its storage limit. New messages will be rejected.

Sign in to request more space.

Sign in now
Example 03Your mailbox is 98% full
  • Asks you to sign in from a link
  • A threat: messages “will be rejected”
  • Generic greeting, no name
  • Check: ask your real IT contact
Training example16:27
From
Director <director.office@quickmail.example>
Subject
Quick favour, are you at your desk?

Hi,

I am in meetings all afternoon and need you to buy some gift cards for a client thank-you. I will pay you back. Keep this between us for now, it is a surprise.

Example 04Quick favour, are you at your desk?
  • A senior name from a personal-looking address
  • Gift cards and secrecy
  • Unusual request outside normal process
  • Check: call the person on a number you know
Training example08:55
From
Parcel Delivery <tracking@delivery-notice.example>
Subject
We could not deliver your parcel

We attempted delivery today but nobody was available.

Confirm your address and pay the 1.99 redelivery fee to rebook.

Rebook delivery
Example 05We could not deliver your parcel
  • A delivery you may not be expecting
  • Asks for a small payment and card details
  • The link text and real address differ
  • Check: use the tracking number from the actual order
Training example10:18
From
HR and Payroll <payroll@hr-portal.example>
Subject
Action required: confirm your details for the new payroll system

We are moving to a new payroll system. Staff who do not confirm their details by Friday may experience a delay in pay.

Please confirm your login and bank details.

Confirm details
Example 06Action required: confirm your details for the new payroll system
  • Asks for a login and bank details together
  • A deadline tied to your pay
  • An announcement you have not heard about elsewhere
  • Check: ask HR in person or by phone

Your briefing and debrief

Fill in the blanks, then print.

Free, no sign-up. Nothing you type leaves your browser. Your answers are saved in this browser only, and fill in the briefing and debrief below.

01Who agreed to it

Write down who approved the exercise before you start.

02When and how

Your documents

Fills in as you type.

Staff briefing script

A practice phishing exercise at

Read out by
Approved by

“Most attacks on organizations like ours start with an email. They are getting harder to spot, and anyone can be caught out, including me.

So , we will send everyone a practice email that looks like a real scam. It will be clearly harmless: it collects nothing, and if you click, you will see a page explaining what to look for.

This is not a test of you. Nobody’s name will be reported, nobody will be in trouble, and there is no score. We are testing whether our reporting works.

What we want you to do, with this email and every suspicious email: report it. . If you clicked something, report it anyway. Reporting a click quickly is the most useful thing you can do, and you will be thanked for it.

If you are ever unsure about a message, ask . A two-minute check is never a waste of anyone’s time.

Afterwards we will share what we learned, as a team, with no names.”

Before you read it

  • Leadership sign-off is written down, with the date.
  • HR or whoever handles staff matters has agreed results are not used against anyone.
  • The reporting route works and someone is watching it.
  • The landing page says “training exercise” and collects nothing.

Debrief sheet

What we learned, together

Organization
Exercise window
Approved by
HR agreed

Totals only. Never write people’s names on this sheet or share who clicked.

Practice emails sent
Reported
Time to the first report
Clicked, then reported
Real suspicious emails reported during the window

What helped people spot it

What made it hard to report

What we will change

Thank you to the team for

Share the totals and the changes with everyone. Thank the people who reported, as a group.

From the free phishing drill kit at moraph.org/commons/phishing-drill.

Sources

Where this comes from.

Primary sources only: standards bodies, governments, regulators and the services themselves. Each was opened and checked on 18 October 2026. If something here no longer matches the source, the source wins; please tell us at hello@moraph.org.

Last reviewed October 2026

  1. UK National Cyber Security CentrePhishing attacks: defending your organisationwww.ncsc.gov.uk/guidance/phishing
  2. CISARecognize and report phishingwww.cisa.gov/secure-our-world/recognize-and-report-phishing
  3. IETFRFC 2606: Reserved top-level DNS names (used for the example addresses)datatracker.ietf.org/doc/html/rfc2606

Want help running training?

Shield can help eligible organizations run a fair awareness session and set up a reporting route that works.

Apply for Shield