Use these if you ever lose access to your authenticator. Each code works once.
⚠ These are shown once. Save them now — we can't recover them later.
Authorization to Test
🔒
Payment Required
Your account is not yet active. Please complete your purchase or contact info@wolfcore.co.uk for assistance.
Company DetailsStep 1 of 8
Changes Requested by Wolfcore:
Company Details
Legal details of the organisation to be assessed.
Contacts & Signatory
Key contacts and the authorised signatory for this engagement.
The signatory must be a director, partner, or officer with authority to commission security testing.
Test Scope
Define which addresses are in scope. All exclusions will be honoured.
One domain per line. Phishing emails will only go to these domains.
Simulation Permissions
What Wolfcore is authorised to simulate.
Time Window & Contacts
Authorised test window and emergency contacts for campaign abort.
Emergency / Abort Contact
Reporting & Data
How results are reported and data handled post-engagement.
Legal Confirmations
All declarations must be confirmed before submission.
Review & Sign
Review your submission. By signing, you legally authorise Wolfcore to conduct phishing simulations on your organisation.
By typing your full legal name below you provide a valid electronic signature and confirm that all information is accurate. This Authorization to Test constitutes a legally binding engagement agreement with Wolfcore Cyber Security.
Signing on behalf of: — · —
📋
ATT Under Review
Your Authorization to Test has been submitted and is being reviewed by the Wolfcore team. Expected review time: 1–2 business days.
✅
ATT Approved
Your Authorization to Test has been approved. Your campaign launch is pending final authorization from Wolfcore. We'll notify you when everything is ready.
✗
ATT Not Approved
Your Authorization to Test was not approved. Contact info@wolfcore.co.uk for assistance.
⏸
Campaign Paused
Your campaign has been paused by Wolfcore. Contact info@wolfcore.co.uk for further information.
⚠️Email delivery setup incomplete.
Your simulations may land in Junk or fail to deliver. Complete the one-time setup so Phishy lands in your employees' inboxes.
Complete setup
⚠️Account deletion scheduled for soon.
Check your email for the cancellation link, or cancel now.
Cancel deletion now
Embeds an inline QR encoding each recipient's tracking link. Scans tag as qr_scan distinct from clicked.
🤖 AI Email GeneratorPowered by Claude
Claude writes the email in this language. Landing and awareness pages stay in English.
🔒 Per-target requires Pro. Business can generate one email per department.
⚠️ SMS / smishing is not authorised on your ATT yet. Open your Authorisation to Test, tick SMS / Smishing Simulations in Step 4 (and the matching confirmation), resubmit for approval, then return here.
{{name}} and {{link}} are substituted per target at send-time. Targets need phone numbers in the CSV.
Use a coined name, a number you own, or the client's own brand. Generic words (Parcel, Alerts) and real brand names are blocked by carriers. US/Canada: number only.
@
🔒 Custom landing pages require the Business plan or higher.
Validate the page before launching. Takes 10–20s.
Used only when a phone is in local format (e.g. 07927 141400). International numbers (+... / 00...) parse regardless.
Format: email, department per line. Department is optional.
TAG THIS UPLOAD (OPTIONAL)
Click a department to tag this upload, or upload without tagging to use the CSV's own department column.
📁
Click or drop a CSV here
Columns: email (required), name (optional, used in {{name}}), department (optional), phone (optional, any format — we normalize using the default country above)
NAME
EMAIL
PHONE
DEPT
STATUS
Click any cell to edit. Status updates on blur.
📞 Voice / Vishing Campaign
Requires voice authorisation on your ATT. Outbound modes additionally require per-employee opt-in and stay disabled until Wolfcore enables outbound calling. Synthetic voices only; every call ends with an awareness reveal.
⚠️ Voice / vishing is not authorised on your ATT yet. Open your Authorisation to Test, tick Voice / Vishing Simulations (and the matching confirmation), resubmit it for approval, then return here. The Create button stays disabled until voice consent is approved.
Auto dials each target from your number for their country (UK target → UK, US → US). Or force one owned number for the whole campaign.
No real brand names — bank / government / big-tech names are rejected. {{code}} is the per-target reference code; {{org}} is your organisation.
Customise script (saved to your library)
Phone required (used for SMS lures and as the key). Email optional — needed only for email lures. International (+44…) parses regardless.
📨 Lure delivery (optional)
Phishy sends each target their lure with their code + the callback number merged in — no hand-copying. On staging, email is sandboxed (won't actually send); SMS is live.
Merge: {{name}}{{code}}{{callback_number}}{{org}}. No real brand names — rejected at launch.
