Phishing training: simulations train clicks, not phone calls

Phishing awareness training built on simulations measures a click on a fake email, not how an employee holds a conversation with a fake counterpart. It remains useful, but it does not prepare people for vishing, phishing by telephone. To cover voice, add spoken practice, with simple verification rules and a debrief.

This article explains what phishing training for employees really measures when it relies on fake emails, where it stops, and how to complete the program without undoing it.

What does a phishing simulation actually measure?

A campaign sends a fake message to employees. The tool then records who clicked, who entered a login and, depending on the set-up, who reported the message. You get a click rate, by team and over time.

It is a valuable indicator for one specific channel: email. It reveals the most exposed populations and makes it possible to test a new alert message. It also gives management a quantified starting point.

But the click is a single, quick and solitary act. The employee is alone in front of their screen, and can stop, look at the sender's address, ask a colleague. Nothing rushes them, except the message itself.

Why the telephone changes the nature of the problem

On the phone, the attacker speaks live. They react to your hesitations, answer your objections, press again when you doubt. The urgency is no longer written, it is in the voice.

The situation resembles an interview more than sorting the mail. Three things set it apart from an email:

• The pace is imposed: the caller decides when you must answer, and silence becomes uncomfortable.
• The relationship is social: refusing a person who seems friendly or in difficulty costs more than deleting a message.
• Nothing remains: no link to hover over, no header to examine, only what you have retained.

Theoretical knowledge (“I never give out my code”) is therefore not enough. You have to say it, aloud, against someone who insists. That is what our article on the psychological levers of social engineering details.

The five limits of fake email campaigns

1. They only test the written word

An employee who is very careful with emails can give in to a well-run call. The two skills only partly overlap. Succeeding at one says nothing about the other.

2. They measure a click, not a verification reflex

Not clicking can come from real vigilance, but also from a badly written message or a day with no time. The click rate does not say whether the person would know how to verify a caller, nor which sentence they would use.

3. They can produce weariness or distrust

When employees feel trapped, some stop reporting for fear of being judged. The program must stay educational: a mistake should lead to an explanation, not a ranking.

4. They are limited to one-way attacks

In a fake email, the employee cannot negotiate, ask a question or hear the attacker change tactics. Yet that is exactly what happens in a real vishing call.

5. They leave out the populations who pick up the phone

Switchboards, reception, help desk, accounts payable, advisors: many roles receive inbound calls by nature. Their exposure comes from the telephone, not the mailbox.

What the figures say about the human factor

Verizon's 2025 Data Breach Investigations Report (DBIR) indicates that the human element is involved in about 60% of the breaches analyzed. This figure is not limited to phishing. It says nothing about the channel. Above all it reminds us that technology alone is not enough.

For voice, no statistic from a single report should serve as proof. The essential point lies elsewhere: telephone methods, such as the fake bank advisor or CEO fraud, rely on speech and timing. A test on a screen does not reproduce them.

What should you add to a phishing campaign?

Do not drop your campaigns. Complete them on three points.

1. Spoken verification rules, short and identical for everyone. For example: hang up and call back on an official number, never the one given by the caller. Our article on the callback procedure through an independent channel details the wording.
2. Practice of the conversation. The employee repeats the refusal sentence, facing someone who insists, until it comes out effortlessly.
3. Reporting measured as much as the click. You count how many people report and with what quality of information.

These three elements are found in the pillar article on security awareness training and vishing.

How to train the voice: role-play

A spoken reflex is built by saying it. Role-play places the employee facing a counterpart who insists, flatters or threatens, and leaves them the floor. They can make mistakes without consequence, then start again.

With Face Up, the trainer writes the scenario from their real cases. The employee speaks to a persona played by an AI, for example a fake supplier. They then receive a debrief with what they said and what they could have done differently. For the full method, see how to build a vishing simulation as an AI role-play.

This type of exercise replaces neither e-learning nor email campaigns. It covers what they do not: speech under pressure.

Imagine a call: what an email test does not see

An accounts payable clerk, whom we will call Daniel, has passed every fake email campaign for two years. One morning, a man introduces himself as the manager of a regular supplier. He says his bank account details have changed and that the day's payment must go out before noon.

Daniel knows the supplier's name, the tone is courteous, and the caller mentions a real invoice. He adds that his finance director is waiting for confirmation. Time is short, the voice grows a little irritated, and Daniel's silence drags on.

No email campaign has taught Daniel the sentence that is needed at this moment. The one that works is simple: “I never change bank details by phone. I’ll call you back on the number in your supplier file.” It takes two seconds to say, but only if it has already been said aloud.

How to read a click rate without going wrong

A good click rate is good news about email, nothing more. Three precautions avoid wrong conclusions.

• Compare what is comparable. A crude fake message and a highly targeted one do not give the same rate. Note the difficulty of each campaign.
• Look at the trend, not the isolated value. A steady fall over several campaigns says more than a one-off figure.
• Cross-check with reporting. A low click rate with no reports at all may mean that nobody saw the message, or that nobody dares say so.

These limits echo those observed for e-learning in general, described in our article on cybersecurity e-learning and reflexes.

A grid to complete your program

Before launching your next campaign, ask yourself four questions. If two answers are “no”, the program has a blind spot on voice.

1. Does every employee exposed to the telephone know a single spoken verification rule?
2. Has each of them already said the refusal sentence, facing someone, before the real day?
3. Do they know whom to report a suspicious call to, and what information to note?
4. Do you measure anything other than the click, for example reporting or success in a spoken exercise?

Frequently asked questions

Should you stop phishing simulations?

No. They measure a real email risk well and raise awareness at scale. The point is not to conclude, from a low click rate, that teams are ready for the telephone.

Can you organize surprise fake calls?

It is possible in some organizations, but it requires a solid legal and social framework (informing employee representatives, anonymity, no sanctions). An announced and debriefed exercise is simpler to set up and more instructive.

Which indicator should you track instead of the click rate?

Track several: reporting rate, reporting delay, quality of reports and success in spoken verification exercises. Our article on measuring the effectiveness of awareness training offers a grid.

Who should train on voice first?

Roles that receive inbound calls or approve operations: reception, help desk, treasury, accounts payable, customer advisors. Start with them, using scenarios drawn from their real cases.

Want to see what a caller verification exercise written by your trainers looks like? Book a Face Up demo.