Article

Why Staff Keep Falling for Phishing, and How 3 Levels of Training Fix It

By Skillermatic Team · October 16, 2026 · 4 min read

A made-up graphic: three levels of training, everyone, by role, then practise and report

Try Skillermatic free Start a free trial and look at the lessons, the admin portal and phishing simulation yourself. Start a free trial →

You ran the training. You sent the reminder. Then one person clicked a fake invoice anyway, and you wonder what else you can do.

Here is the good news. Staff who click are rarely careless. Phishing is built to catch smart, busy people in a bad moment. And a better plan, built in three levels, changes what people do in that moment.

Why smart people still click

Four reasons staff click: rushed, trusting, on a phone, afraid to ask

They are rushed. The message says “urgent” or “final notice”. Busy people act first and think later.
They trust the name. The display name says “Dana (CEO)” or a bank. Anyone can type any name. A lookalike address, such as an “rn” in place of an “m”, is easy to miss. CISA lists “slight character changes” in a sender address as a sign of phishing.
They are on a phone. A small screen often hides the full sender address and the real link.
They are afraid to ask. If reporting feels like getting in trouble, people stay quiet, and the quiet click grows.

None of these is a knowledge gap that one video can close. They are habits under pressure. So the training has to build habits.

Level 1: Everyone learns the basics

The 3 levels of training: basics for everyone, role lessons for targets, practise and measure

Every employee gets a short, plain set of lessons. The goal is one habit: pause, check, report.

How to read a sender address and where a link really goes.
The red flags: surprise, rush, secrecy, money, passwords and odd attachments.
Where and how to report.

In Skillermatic this is the All-Staff Core track, plus Phishing Defense Essentials for anyone who wants more depth (for example, QR phishing, fake login pages, and text and phone scams). New hires finish the core track in their first 30 days.

Level 2: Role lessons for the people criminals target

Not everyone is attacked the same way. Give the high-risk roles the lessons that match their day.

Finance and payments: fake invoices, “we changed our bank account” emails, and the callback rule for payment changes. (Track: Finance & Payments, with lessons such as Business Email Compromise & Invoice Fraud and Verifying Payment Changes: The Callback Rule.)
Managers and executives: boss-impostor scams and fake-CEO requests, and how to build a reporting culture. (Track: Managers & Executives.)
IT and admins: MFA prompt bombing, admin account hygiene and ransomware basics. (Track: IT & Admins.)
Remote and hybrid staff: phishing on home networks, video-call safety and file sharing. (Track: Remote / Hybrid Workers.)

The FBI reports that business email compromise, where criminals pose as a boss or supplier to get a payment, caused about $55.5 billion in losses between October 2013 and December 2023. The people who approve payments are the ones to train first.

Level 3: Practise safely, then measure

Knowing the rules is one thing. Using them in the moment is another. So give people safe practice.

Tell staff the program exists. Be open that practice emails will come from time to time. Do not announce the day.
Send a realistic but fake email. In Skillermatic every template is fictional and the links go to a safe page.
Teach right after a click. A short lesson in the same minute lands better than a late warning. In Skillermatic a remediation lesson is assigned automatically.
Look at the numbers. Track the report rate, the click rate and repeat clickers.
Change the scenario and repeat. New tricks each time: a fake invoice, a locked account, a calendar invite.

Skillermatic limits campaigns to a rolling 30 days per company, to avoid simulation fatigue.

What to measure

Report rate goes up over time. This is your main win.
Click rate goes down over time.
Repeat clickers get an extra short lesson, not a telling-off.
Time to report gets shorter. A fast report limits damage.

A 30-day plan for HR and L&D

Week 1: Announce the program and the “no blame” rule. Assign All-Staff Core to everyone.
Week 2: Assign role tracks to finance, managers and IT admins.
Week 3: Send the first simulation to a small group. Teach after the click.
Week 4: Look at the report rate. Share a short “what we learned” note. Pick next month’s scenario.

Keep it human

Say thank you to everyone who reports, including the ones who reported a real email that turned out fine. The goal is a team that speaks up in the first minute.

Want a quick way to start Level 1 today? Send your team the free Spot the fake email quiz. It has 12 made-up emails. Staff pick real or fake and see the clues. It takes 3 minutes, needs no sign-up, and nothing they click is saved.

Sources

Questions people ask

Why do employees fall for phishing emails?

Usually because of the moment, not because they are careless. A message creates a rush or fear, looks like someone they trust, or arrives on a small phone screen that hides the full address. CISA lists the common signs: a sender address with slight character changes, generic greetings, mismatched links and unexpected attachments.

Does annual security awareness training work?

A yearly session is a good start for a record, but habits fade. Short lessons, role-specific topics and regular safe practice keep the skill fresh. Many teams run a short lesson regularly and a practice email each month or quarter.

What are the 3 levels of phishing training?

Level 1 is the basics for every employee. Level 2 is role-based lessons for the people criminals target most, such as finance, managers, IT admins and remote staff. Level 3 is practice and measurement: safe fake phishing emails, a quick lesson after a click, and a report rate you can track.

Who needs extra phishing training?

Staff who can move money or change payment details, managers whose names are used in boss-impostor scams, IT admins with powerful logins, and remote workers. Skillermatic has tracks for each.

Should we punish people who click?

No. People who fear trouble stay quiet, and quiet clicks do the most damage. Treat a click as a chance to teach, and thank people who report fast.

How do we measure whether phishing training works?

Track the report rate, the click rate and repeat clickers over time. Report rate matters most, because it shows people are alert and willing to speak up.