Program staff
Use fictional participants, partners, cases, services, and documents, particularly when programs involve children or vulnerable people.
For Nonprofits
Phishing Simulation Planning for Nonprofit Organizations
Nonprofits coordinate donors, beneficiaries, volunteers, boards, grant makers, vendors, and program partners—often with lean staffing and shared technology support.
A responsible simulation should strengthen reporting and verification without exploiting the mission, imitating a beneficiary emergency, or exposing donor and program information.
Small-team planning • Relevant scenarios • Simple measurement • Practical follow-up
01Understand the team
Design around how small nonprofit teams actually work
Start with a business decision employees already make and the safe verification route available to them. A small organization benefits more from one focused exercise it can support than from a complicated campaign with unclear follow-up.
Fundraising and communications
Practice donor, event, shared-file, and account decisions without copying a real donor identity, appeal, gift, or mailing list.
Finance and grants
Reinforce callback and approval procedures for vendor banking, grant portals, invoices, reimbursements, and executive requests.
Volunteers and boards
Treat each population separately when policy, identity, device, support, consent, and data access differ from employees.
02Choose the scenario
Use a familiar request with a clear next step
Give each scenario one learning objective and use fictional people, organizations, accounts, and transactions. Avoid exploiting a real deadline, dispute, employee concern, or customer problem.
Grant document share
Practice checking an invented funder, document owner, access request, and destination before opening the file.
Vendor bank change
Ask finance staff to use the established callback and approval process for a fictional provider.
Board portal notice
Reinforce independent access to the known board or governance service after an unexpected sign-in request.
Donation-platform alert
Practice reaching the normal fundraising service independently without referencing a real donor, gift, or campaign.
03Write the brief
Answer four questions before sending anything
| Decision | Question to answer | Required preparation |
|---|---|---|
| Population | Are employees, volunteers, board members, contractors, or partners included? | Define authority, notice, support, data handling, and follow-up separately for each population. |
| Sensitive people | Could the scenario reveal or exploit a beneficiary, donor, patient, child, survivor, or vulnerable person? | Use entirely fictional, low-distress details and complete the relevant privacy and safeguarding review. |
| Mission trust | Could the message imitate an emergency appeal, community crisis, or urgent service need? | Avoid manipulating the mission or weakening confidence in genuine emergency communications. |
| Lean support | Who receives reports and real incidents when IT is outsourced or part time? | Name primary and backup contacts, brief the provider, and test the complete reporting handoff. |
04Run the exercise
Use a manageable five-step workflow
- 1
Choose one behavior
State the request being tested, the expected verification or reporting action, the approved audience, and how the observation will be used.
- 2
Name the owner
Assign the person who approves the message, handles questions, monitors impact, stops the exercise, and makes sure follow-up occurs.
- 3
Test the complete path
Use approved test accounts to check delivery, links, landing pages, supported devices, event records, reports, and follow-up material.
- 4
Launch with support available
Brief the responsible employee or IT provider and avoid business-critical deadlines, staff absences, and active incidents.
- 5
Make one improvement
Debrief the expected action, provide relevant private learning, and assign the most useful workflow or control improvement to an owner.
05Measure responsibly
Use results the business can act on
Record intended recipients, successful deliveries, exclusions, unique recipient events, verified reports, response handling, and completed follow-up. Separate repeated activity and automated link inspection from confirmed employee actions.
Keep employee, volunteer, board, contractor, and partner results separate when their conditions differ. Show actual counts, protect small-group identities, and document device, delivery, prior guidance, and reporting access before drawing conclusions.
Treat the review as input for improving reporting, verification, email, identity, access, backup, or provider processes. One interaction does not explain why a decision occurred and should not become an employee risk score.
Common questions
Common questions about Phishmake's features, onboarding, and support, answered to help you get started with confidence.
Should nonprofit volunteers receive phishing simulations?
Not automatically. Define a legitimate learning purpose and confirm authorization, policy, notice, identity, device, support, data handling, and follow-up for volunteers separately from employees.
Can a campaign use an emergency donation appeal?
Avoid mission-related emergencies, beneficiary distress, disasters, and active appeals. These themes can cause harm and weaken trust in genuine nonprofit communications.
Can donor information make a scenario more realistic?
Use invented donors, gifts, campaigns, and platforms. Do not copy donor identities, giving history, payment information, mailing lists, or private correspondence.
How should a small nonprofit report results?
Use restricted, contextual reporting with counts, delivery, unique events, verified reports, follow-up, and process findings. Avoid public rankings or small groups that reveal individual activity.
Sources & further reading
Published by Phishmake · Updated
Keep building your program
All resourcesPut it into practice
Build practical awareness for nonprofit organizations.
Explore how Phishmake connects controlled employee simulations, relevant training, activity records, and campaign reporting in one workflow.