Phishing simulation for accounting firms

A phishing simulation for an accounting firm sends the team decoy emails that imitate requests typical of the financial world, such as an invoice or a request to change bank details, and measures who opened, clicked or reported. With PhishingU you can run it yourself from ₪999 per one-time campaign (up to 100 employees), in Hebrew and with a summary report.

Last updated: 19.10.2026 | Written and reviewed by the PhishingU team

Get started now · from ₪999*A free initial check of the domain

* Setup in under 15 minutes, with no technical knowledge - one simple action is required from IT (allowlisting the sender), and launch is subject to a security review of up to one business day.

Why accounting firms are a phishing target

An accounting firm holds clients' financial data and account details, so it is a favorite target for payment fraud.
Busy seasons, such as report filing, create time pressure that makes it easier for an attacker to exploit a request that looks urgent.
Email is a central channel for passing documents and invoices, so a fake message looks natural.

Three scenarios that suitaccounting firms

An invoice or a payment confirmation

An email that looks like an invoice or a transfer confirmation, with a link to view it.

A change of bank details

A message that looks like a client or a supplier asking to update account details.

A document for urgent signature

A message that looks like a document from the authorities or from a client demanding a quick response.

The scenarios are general types of requests for practice, with no impersonation of a real brand.

What is measured inaccounting firms

Whether the firm's employees click emails that look like an invoice or a payment confirmation.
Whether requests to change bank details are passed to phone verification before being carried out.
Whether there is a difference between senior employees and temporary employees in a busy season.

How to prepare the team

Set a simple procedure: every request to change payment details is verified through an additional channel.
Schedule the exercise outside the biggest busy weeks so that the training sinks in.
Include in the report an example of a fake invoice and explain what could have been noticed.

What you get at the end

A summary report with open, click and report rates, and a certificate of participation in awareness training. The certificate is evidence of training that helps meet part of the requirements of Amendment 13; it is not a confirmation of full compliance with a law or a standard. Payment is a one-time payment from ₪999 per campaign (up to 100 employees), with no subscription. See the The full price list.

Frequently asked questions

Why does an accounting firm need a phishing simulation?

Because it holds sensitive financial information and requests to change payment details are part of the routine. A simulation shows which scenarios work on the team and lets you train accordingly.

Is it suitable for customers who ask for proof of employee training?

The report and the certificate of participation document that an exercise and training took place. They are not a certification, so if a customer asks for a particular standard, check what is actually required.

How much does it cost for a small firm?

From ₪999 per one-time campaign, up to 100 employees, with no subscription.