It was pretty much this scenario years back, as a result of that exact same scenario being used by bad actors. The real thing happened, was detected and shut d

It was pretty much this scenario years back, as a result of that exact same scenario being used by bad actors. The real thing happened, was detected and shut down. Then they did some trainings over the course of a year, and had us test the same thing again next year. Results were not particularly good, and people got upset that they did not receive the promised Christmas gifts. Afaict, these trainings stop being effective at around 10%. That is, 10% of all people being phished like this will do everything you tell them to. Up to and including sending your their password and installing malware on their machines following your e-mail instructions.