Help Questions and support
Frequently asked questions and troubleshooting
On this page
General questions
What is PhishTrainer for?
PhishTrainer trains your employees to recognize phishing. It sends them simulations (emails or SMS) and measures their reactions: opening, clicking, entering data, reporting. You see who needs training and how vigilance changes from one campaign to the next.
Can I use PhishTrainer to send real malicious emails?
No. PhishTrainer is only for training the people in your organization, with harmless simulations. Any other use is forbidden.
Do I have to create the phishing emails and landing pages myself?
No. The Phishing templates, Phishing SMS and Landing pages menus contain a Templates bexxo tab with ready-to-use templates. You can also create your own. These menus are visible from the Supervisor role upwards.
Accounts and sign-in
How do I give a colleague access to PhishTrainer?
Open My organization > People, then Add a person. Choose their PhishTrainer role (Target, Viewer, Supervisor or Administrator) in Services & permissions, then click Generate access: the person receives their sign-in details by email. This menu is reserved for the account administrator and for people with the Manage people permission.
I forgot my password. What should I do?
- On the sign-in page, click Lost password ?.
- Enter your email address: a 6-digit verification code is sent to you.
- Enter this code. A new password is sent to you by email.
If the code does not arrive, check your spam folder or contact your organization’s administrator. They can also reset your password from your record (Reset password). Then change the password you received in My profile.
Sending simulations
How does PhishTrainer send emails? Can I use my own domain?
Simulated emails are sent through a sending profile: Settings > Sending profiles, reserved for the Administrator role. A profile contains the Sender name:, the Email: address and the SMTP settings (Server:, Port:, Username:, Password:, SSL / STARTTLS:). With your own SMTP server, you send from your own domain. The Templates bexxo tab offers profiles supplied by Bexxo.
If your organization has enabled client-side encryption, emails are sent by the sending agent installed in your environment.
How do I stop simulations being blocked or marked as spam?
- Allow PhishTrainer simulations in your email filtering (allow list). For Microsoft 365, follow the guide below.
- If you send from your own domain, publish SPF, DKIM and DMARC records that cover your sending server.
- Before a campaign, use Send a test in the sending profile, then in the campaign.
Results and reports
Which indicators should I track to assess a campaign?
The Dashboard shows Emails opened, Links clicked and Data submitted. The fewer clicks and submitted data, the better the vigilance. The Reported rate, in the statistics per target and per group, shows the opposite: a good reflex, so the higher the better. Compare these values from one campaign to the next to track progress.
Are the results anonymous?
Only if you choose so:
- when creating the campaign, tick Anonymize campaign results?: the results are shown without the targets’ name, email or number;
- once the campaign is complete, Anonymize data, in its results, permanently deletes the targets’ personal data. Only aggregated statistics are kept. This action cannot be undone.
How does PhishTrainer know that an employee reported a simulation?
Reports arrive through the sources configured in Settings > Réception des signalements: a reporting mailbox collected over IMAP or through Microsoft 365 (Graph), the Outlook add-ins (Microsoft 365 and Windows) and the Gmail add-on. Each reported email appears in Suspicious emails; the PhishTrainer simulations filter isolates the recognized simulations. The statistics per target and per group show the Reported rate.
Can I forward PhishTrainer events to another system?
Yes, with a webhook: Settings > Webhooks, reserved for the Administrator role. A webhook has a name, a destination URL and an optional secret. PhishTrainer sends HTTP POST requests in JSON format; if a secret is set, each request is signed (header X-Gophish-Signature). Only webhooks marked as active receive data.
Data and security
Where is my data hosted?
The data is hosted exclusively in Switzerland.
What is client-side encryption?
It is an option enabled organization by organization. Your employees’ personal data (last name, first name, email address, group names) is encrypted and decrypted only in the browser. On our servers, it remains unreadable, including for Bexxo. Each authorized person opens the data key with their own passphrase.
What happens if a passphrase is lost?
Bexxo cannot send it back: we do not know it. An administrator of your organization gives the person access again. If no administrator can open their vault any more, the recovery code issued at activation lets you regain control. If all passphrases and the recovery code are lost, the encrypted data becomes permanently unreadable.
Troubleshooting
Messages in quotation marks are those displayed by PhishTrainer.
| Symptom | Likely cause | Solution |
|---|---|---|
| “The entered login information is wrong.” | Incorrect email address or password. | Check what you typed, including upper and lower case. Otherwise, use Lost password ?. |
| The verification code does not arrive. | Email filtered or delayed. | Check your spam folder. If the code still does not arrive, contact your organization’s administrator. |
| “Your account is not yet set up for this sign-in method. Please contact your organization's administrator.” | SSO sign-in while your account has not yet been created in PhishTrainer. | Ask the administrator to create your access or to check the directory synchronization (Directory and SSO). |
| “Your organization protects its data with encryption and your access has not been activated yet…” | Your organization uses client-side encryption and you do not have a key yet. | An administrator gives it to you in My organization > People (Give an encryption key), then sends you your temporary passphrase. |
| A PhishTrainer menu is missing. | Your role does not give access to this page. | The Viewer role sees the Dashboard and Help; Supervisor adds campaigns, targets, templates and suspicious emails; Settings is reserved for Administrator. Ask the account administrator for another role. |
| The new password is rejected. | It does not meet the rules. | Use at least 12 characters, including an uppercase letter, a lowercase letter, a digit and a special character. |
| The test send of a sending profile fails. | Incorrect SMTP setting. | Check Server:, Port:, Username:, Password: and SSL / STARTTLS: with your email provider, then click Send a test again. |
| Simulations do not arrive or land in spam. | Your email filtering blocks them. | Allow the simulations in your email system (see “How do I stop simulations being blocked”), then send a new test. |
| “Please select a phishing email and a landing page first.” | Test send of an incomplete campaign. | Choose the Phishing: and the Landing page:, then click Send a test again. |
| “This campaign is currently sending and can no longer be modified.” or “This campaign is complete and can no longer be modified.” | A launched campaign is locked. | In the campaign list, use Copy Campaign to create a new one from its settings. |
| “This source was saved without encryption: it is no longer collected.” | IMAP source saved without an encrypted connection. | In Réception des signalements, choose an encryption mode, click Test the connection, then save. |
Contact support
If these answers do not solve your problem, write to info@bexxo.ch, describing what you were doing and the message displayed.
If support needs to work in your space, the account administrator manages this access in My organization > Support access.
Didn’t find the answer? Contact us