Use these if you ever lose access to your authenticator. Each code works once.
⚠ These are shown once. Save them now — we can't recover them later.
Authorization to Test
Payment Required
Your account is not yet active. Please complete your purchase or contact info@wolfcore.co.uk for assistance.
Company DetailsStep 1 of 8
Changes Requested by Wolfcore:
Company Details
Legal details of the organisation to be assessed.
Contacts & Signatory
Key contacts and the authorised signatory for this engagement.
The signatory must be a director, partner, or officer with authority to commission security testing.
Test Scope
Define which addresses are in scope. All exclusions will be honoured.
One domain per line. Phishing emails will only go to these domains.
Simulation Permissions
What Wolfcore is authorised to simulate.
Time Window & Contacts
Authorised test window and emergency contacts for campaign abort.
Emergency / Abort Contact
Reporting & Data
How results are reported and data handled post-engagement.
Legal Confirmations
All declarations must be confirmed before submission.
Review & Sign
Review your submission. By signing, you legally authorise Wolfcore to conduct phishing simulations on your organisation.
By typing your full legal name below you provide a valid electronic signature and confirm that all information is accurate. This Authorization to Test constitutes a legally binding engagement agreement with Wolfcore Cyber Security.
Signing on behalf of: — · —
ATT Under Review
Your Authorization to Test has been submitted and is being reviewed by the Wolfcore team. Expected review time: 1–2 business days.
ATT Approved
Your Authorization to Test has been approved. Your campaign launch is pending final authorization from Wolfcore. We'll notify you when everything is ready.
ATT Not Approved
Your Authorization to Test was not approved. Contact info@wolfcore.co.uk for assistance.
Campaign Paused
Your campaign has been paused by Wolfcore. Contact info@wolfcore.co.uk for further information.
⚠️Email delivery setup incomplete.
Your simulations may land in Junk or fail to deliver. Complete the one-time setup so Phishy lands in your employees' inboxes.
Complete setup
⚠️Account deletion scheduled for soon.
Check your email for the cancellation link, or cancel now.
Cancel deletion now
Adds a QR code to the email that opens the same tracked page. Scans are reported separately from clicks.
AI Email GeneratorPowered by Claude
Claude writes the email in this language. Landing and awareness pages stay in English.
Per-target requires Pro. Business can generate one email per department.
⚠️ SMS / smishing is not authorised on your ATT yet. Open your Authorisation to Test, tick SMS / Smishing Simulations in Step 4 (and the matching confirmation), resubmit for approval, then return here.
{{name}} and {{link}} are substituted per target at send-time. Targets need phone numbers in the CSV.
Use a coined name, a number you own, or the client's own brand. Generic words (Parcel, Alerts) and real brand names are blocked by carriers. US/Canada: number only.
Custom landing pages require the Business plan or higher.
Validate the page before launching. Takes 10–20s.
Sends one copy to your account email so you can check how it looks. Nothing is recorded.
Used only when a phone is in local format (e.g. 07927 141400). International numbers (+... / 00...) parse regardless.
Save a list once, for example "Finance team", and load it into any campaign. Everyone in a group needs an email address.
Format: email, department per line. Department is optional.
TAG THIS UPLOAD (OPTIONAL)
Click a department to tag this upload, or upload without tagging to use the CSV's own department column.
Click or drop a CSV here
Columns: email (required), name (optional, used in {{name}}), department (optional)
NAME
EMAIL
PHONE
DEPT
STATUS
Click any cell to edit. Status updates on blur.
Voice / Vishing Campaign
Requires voice authorisation on your ATT — your ATT voice consent covers your employees. Outbound modes stay disabled until Wolfcore enables outbound calling; add anyone to the exclusion list to suppress them. Synthetic voices only; every call ends with an awareness reveal.
⚠️ Voice / vishing is not authorised on your ATT yet. Open your Authorisation to Test, tick Voice / Vishing Simulations (and the matching confirmation), resubmit it for approval, then return here. The Create button stays disabled until voice consent is approved.
AI voice delivers the code to the target during the call, so the assistant can ask them to read it back. Email needs a target email address (falls back to SMS).
UK numbers only — US/Canada carriers ignore custom names and use a number. No real brand names. Leave blank for the default sender.
The AI conducts the whole call — pretext, code request, and the awareness reveal — in this language, with a native ElevenLabs voice.
Auto dials each target from your number for their country (UK target → UK, US → US). Or force one owned number for the whole campaign.
No real brand names — bank / government / big-tech names are rejected. {{code}} is the per-target reference code; {{org}} is your organisation.
Customise script (saved to your library)
Phone required (used for SMS lures and as the key). Email optional — needed only for email lures. International (+44…) parses regardless.
Lure delivery (optional)
Phishy sends each target their lure with their code + the callback number merged in — no hand-copying. On staging, email is sandboxed (won't actually send); SMS is live.
Merge: {{name}}{{code}}{{callback_number}}{{org}}. No real brand names — rejected at launch.
