The article considers the possibility of working with scenarios of dynamic response to phishing attacks, taking into account the possibility of presetting such systems on the basis of user behavioral analysis data and formation of risk groups based on the analysis of such preliminary data. A multilevel system of processes that allows to realize the presented approach, as well as a general algorithm and examples of its application are shown. The results of the work in turn can be used in systems that perform individual traffic filtering based on knowledge about users collected by additional modules or obtained through integrated systems. As a result, the application of these results can reduce the risks of successful realization of phishing attacks.