How we run a phishing test, and what we never do
Fluxive gives cyber-awareness workshops for small businesses, hotels and local councils in Belgium. Some clients also ask for a phishing test: a harmless fake scam email sent to staff, to count how many people click it and how many report it. A test like that only helps if the people who receive it can trust how it is run. These are the rules we follow for every client.
The employer agrees in writing
We send test emails only after the employer has given written permission. The test is part of a workshop or a training plan the employer asked for, never a surprise from us.
Staff hear about it first
Before a test, staff are told that test emails will arrive during a set period. They are not told the day or what the email will look like, because a test they can see coming measures nothing. The notice comes from the employer, and we supply a short text for it.
Results per team, never by name
The report shows how many people clicked and how many reported the email, for the team as a whole. It contains no list of names and no score per person.
Nobody is punished for a click
A click is something to learn from. The test is there to show the team which signals to look for, and the workshop that follows uses the team result, not individual mistakes.
What a test email does
A test email carries no virus and does no harm. Someone who clicks lands on a page that explains the warning signs in that email.
What the research says about limits
A 2025 study at UC San Diego Health followed more than 19,500 staff through ten test campaigns. People who saw a training page after clicking failed later tests only about 1.7 percentage points less often than people who saw nothing, and most closed that page within seconds. So we treat the team result as a rough signal and a starting point for the workshop. The researchers recommend technical measures such as two-step sign-in. We agree, and add a rule to phone back before changing any payment details.
What the employer does under Belgian law
Private employers who monitor staff email and internet use follow collective agreement no. 81 of the National Labour Council. A training test may fall outside its core, but its steps are a sensible minimum: inform the works council; if there is none, the prevention committee; if there is none either, the union delegation; failing that, the staff themselves. Tell each employee what the test is for and whether data is kept.
Under the GDPR the employer is responsible for the processing. Consent from staff is not a valid basis at work, so the employer records why the test is needed and checks whether a data protection impact assessment is required.
Municipalities and other public bodies follow different rules: national collective agreements do not apply to them, and their data protection officer should confirm the legal basis before a test. We point these steps out before a test starts. The decisions stay with the employer.
This page describes our practice
This page explains how Fluxive works. It is not legal advice. For questions about your own obligations, ask your employment lawyer, your social secretariat or your data protection officer.