Almost never on its own. A failed phishing simulation is a training signal, not an act of misconduct. Australian employment law asks whether the reason for a dismissal was valid and the process fair, and a single click on a simulated email fails both tests in almost every case. Where click data can legitimately feed into discipline is as part of a documented pattern - repeated failures, refusal to complete remedial training, or deliberate breaches of a security policy the employee knew about and ignored.
TL;DR
- One click in a phishing simulation is not serious misconduct: the legal test requires wilful, deliberate behaviour causing serious and imminent risk, and a single simulated click rarely meets it.
- The Fair Work Commission weighs the reason, the process and the proportionality of the outcome - a click-based dismissal is exposed on all three.
- Employees have 21 days from dismissal to lodge an unfair dismissal claim, and compensation awards run well into five figures.
- A graduated policy - coaching after a first failure, formal warning after repeated failures - is legally safer and changes behaviour better than termination.
- Click data belongs in a training loop, not an employment decision.
Why this question comes up
Phishing simulations are now standard in Australian workplaces, and they generate something annual training never did: individual, named, timestamped data about who clicked what. Managers look at a campaign report, see a name at the top of the click list, and ask the question this article answers.
The impulse is understandable. A real phishing click can be the first step in a business email compromise, a ransomware deployment or a payroll diversion scam - attacks that regularly cost Australian small businesses tens or hundreds of thousands of dollars. The gap between "clicked a fake email" and "cost the company everything" feels small, so a severe response feels proportionate.
The law sees it differently - and the law's reasoning tracks what actually changes behaviour.
What the Fair Work framework actually requires
Under the Fair Work Act, a dismissal needs a valid reason connected to the employee's conduct or capacity, and a fair process. In deciding whether a dismissal was harsh, unjust or unreasonable, the Commission considers a set of statutory factors, including whether there was a valid reason, whether the employee was notified of it and given an opportunity to respond, and whether the outcome was proportionate to the conduct.
The category employers reach for after a failed simulation is serious misconduct. But the Fair Work Ombudsman's own guidance defines serious misconduct as deliberately behaving in a way inconsistent with continuing the employment relationship, or causing serious and imminent risk to the health or safety of another person or to the reputation or profits of the business - with examples like theft, fraud, assault, sexual harassment, or refusing to carry out a lawful and reasonable instruction that is part of the job (Fair Work Ombudsman, serious misconduct).
A missed phishing test fits none of those words. Clicking a convincing simulated email is not wilful, not deliberate in the sense the test requires, and not a refusal of an instruction unless one was actually issued and ignored. Even where conduct is genuinely serious, a dismissal without procedural fairness - notice of the allegation, a chance to respond, a support person - is likely to be found unfair regardless of the underlying reason.
And the downside is not theoretical. An employee has 21 days from dismissal to lodge an unfair dismissal application with the Commission, and if the claim succeeds the Commission can order reinstatement or compensation up to a statutory cap - currently half the high income threshold, which puts the exposure well into five figures (termination for serious misconduct - employer guide). Procedural failures - no support person, no evidence presented before the decision, no chance to explain - are among the most common ways employers lose otherwise defensible cases.
What a click actually proves
Set the law aside and ask the more useful question: what does a single click tell you?
Very little, and less than most managers assume. Clicking a simulated phish measures one response to one email on one day. It does not measure whether the employee would report a real attack, whether they completed their training, whether they were rushing between meetings, or whether the template was one of the genuinely hard ones. Security awareness professionals treat click rate as a programme metric - a trend across campaigns - precisely because single data points are noise.
The practical research backing this is consistent: a click is best read as a teachable moment. The person who clicks and immediately receives a short coaching lesson is measurably less likely to click the next one. The person who clicks and is marched into a termination meeting has learned something else - that reporting mistakes is dangerous. That lesson trains your whole workforce to stay quiet when they see something real, and under-reporting is more dangerous than clicking, because a reported suspicion is what starts an investigation before money moves.
When click data can legitimately support discipline
This is not a get-out-of-jail card for employees. There are patterns where simulation data, combined with other evidence, legitimately supports a formal process:
- A documented pattern of repeated failures. An employee who clicks several campaigns in a row, declines the coaching each time, and shows no engagement with remedial content presents a performance issue you can evidence.
- Refusing training outright. Repeatedly failing to complete assigned remediation after reasonable notice approaches a refusal to follow a lawful and reasonable instruction.
- Deliberate bypass of security controls. Knowingly disabling protections, sharing credentials, or deliberately circumventing a policy is a different category from being deceived by a simulation.
- The simulated click as the visible tip. Occasionally a simulation reveals an actual compromise - the employee clicked because a real scam was already in motion. That is an incident response matter first, not a discipline matter.
Even in these cases, the click is the entry point for a documented, graduated process - not the verdict.
What a defensible policy looks like
If you run phishing simulations, write the response ladder before the first campaign, and make sure it is reflected in your employment contracts or security policy so employees know the rules in advance:
- First click: automatic short coaching module. No record beyond the campaign report.
- Repeated clicks or no engagement with coaching: a documented conversation with the manager, plus a refresher module.
- Persistent pattern after coaching and warnings: formal performance management - the same process you would run for any other capability concern.
- Deliberate policy breach: your standard misconduct process, which is about the deliberate conduct, not the click.
Then make the first rung genuinely automatic. A platform that assigns a coaching lesson the moment someone clicks phishing simulations means the first response never depends on a manager remembering - which is what makes the ladder defensible in practice, not just on paper.
Make training the remedy, not the warning shot
The organisations that get value from phishing simulations treat every click as a curriculum event. The follow-up matters more than the failure: a two-minute module on what the fake invoice looked like, a team-level debrief, a retest two weeks later. Over a few months, the trend in your human risk reporting tells you whether the programme is working - and it builds the documented history you would need if any individual case ever did escalate.
If clicks cluster in one team or one role, treat that as a programme finding, not a staffing decision. Target the training, adjust the template difficulty, and measure again before anyone's job enters the conversation. A structured security awareness training programme with a steady cadence gives you that baseline; a one-off punitive campaign does not.
Common mistakes employers make here
- Treating the click list as a conduct league table. It is a risk map. The names on it need coaching, not consequences.
- Running simulations with no published policy. If employees were never told what happens after a click, any adverse action looks arbitrary.
- Skipping procedural fairness at any step. Even informal conversations should be documented and give the employee a chance to respond.
- Public shaming. Naming clickers in all-staff emails suppresses reporting across the whole business.
- Confusing simulation results with investigation findings. A simulation tells you about training needs. Only a real investigation tells you about an incident.
FAQ
Can I dismiss someone for clicking a phishing simulation? You can dismiss someone for any reason in the narrow legal sense, but a click-based dismissal is very likely to be found harsh, unjust or unreasonable, because a single simulated click is neither a valid misconduct reason nor a proportionate basis for termination. Build a graduated policy instead.
Does a click breach the employee's duties? Only if your policies make it one - and even then, an honest mistake is normally a training matter. Deliberate breaches are a different category.
What if they clicked and entered their password? Credential entry is more serious, but the response ladder is the same, escalated: incident response first (reset the credentials), coaching second, formal process only if there is a pattern of deliberate behaviour.
Can simulation data be used in a performance conversation? Yes - as part of a documented, evidence-based process, with the employee told what the data shows and given a chance to respond and improve.
Is this legal advice? No. For any specific dismissal decision, get advice from an employment lawyer or use the Fair Work Ombudsman's resources before acting.