The phishing page could be set up to have a fake form that sends no data, and says "you've been phished" when someone tries to submit information to it. At tha

The phishing page could be set up to have a fake form that sends no data, and says "you've been phished" when someone tries to submit information to it. At that level, though, the pen-tester really ought to have control over the phishing landing page.