Simulated phishing for law & accounting firms

Your staff will be phished. The only question is by whom.

We send your team realistic phishing emails, the same lures criminals aim at law firms, before the criminals do. Whoever clicks gets two minutes of training, not a very bad month.

Test my firm
Better fooled by us than robbed by them. Monthly simulations, per-person training, results reviewed with you.
Inbox · 09:12 Tuesday
From: HMRC Repayments <refunds@hmrc-gov-refunds.com>1
To: accounts@yourfirm.co.uk
URGENT: Client account VAT repayment pending action2

Dear Customer,3

A VAT repayment of £4,617.20 relating to your client account could not be processed. To avoid reversal of this repayment, verify your account details within 24 hours.

Verify account now4
Link points to: hmrc-gov-refunds.com/verify?id=88231
1 The sender isn't hmrc.gov.uk. It's a lookalike domain registered last week.
How it works

Fooled in private, so they're never fooled in public

Inbox · Tuesday 09:12
Land Registry
Title deed update TR1/884
HMRC Repayments
URGENT: VAT repayment pending
Sarah (Practice Manager)
Partners meeting agenda
01 · The lure
A hook lands in the inbox
Realistic, legal-flavoured, unpredictable timing.
That was one of ours.
You just clicked a simulated phish. Here's the 2-minute lesson on the three tells you missed.
Lesson: spotting lookalike domains0:48 / 2:00
02 · The catch
Caught kindly, taught instantly
Two minutes, right then. No naming, no shaming.
Your firm's click rate
26% 4%
Month 1Month 6
03 · The curve
The click rate falls
Reviewed with you at every business review.
The lures

We phish the way criminals phish law firms

No generic "free iPhone" nonsense. These look like your Tuesday morning.

LURE
DS
DocuSign <docusign-notify.com> · 08:47
Settlement agreement ready for signature
All parties have signed. Review and complete before 5pm today...
LURE
CC
Temple Court Chambers <clerks-mail.net> · 12:03
Amended defence attached, urgent review
Counsel has amended paras 14-19 ahead of tomorrow's hearing...
LURE
HM
HMRC Repayments <hmrc-gov-refunds.com> · 09:12
Client account VAT repayment pending action
A repayment of £4,617.20 could not be processed. Verify within 24 hours...
LURE
IT
IT Helpdesk <support-desk.info> · 16:41
Your mailbox is full
You will stop receiving email in 2 hours. Click to increase your quota...
The result

Watch the click rate fall

The first simulation is always a shock. Then the curve starts bending: month by month, fewer clicks, faster reporting, and a team that forwards suspicious emails to us instead of opening them.

You see the numbers at every business review, and so do your partners. Risk you can actually watch shrinking.

Staff who clicked the simulation
Illustrative programme, first six months
Month 1 Month 6

Better fooled by us
than robbed by them.

Criminals get one attempt at your firm to succeed. Your team gets twelve a year to practise. That's the whole idea.

Start the programme

Find out who'd click, before someone real does

The first simulation tells you everything

A quick call to scope your firm, then your first campaign goes out. The results usually make the decision for you.

Test my firm