This was a safe simulation
No real harm was done. Your IT & Security team sent this on purpose so you could learn to spot the next one.
This was an MFA-fatigue simulation.
Never approve an MFA prompt you did not initiate. Report the attempt.
Three habits that would have caught this
- 1.Hover before you click. Your email client shows the real destination domain in the lower-left. Look for it. A single-letter swap is the giveaway.
- 2.Verify out-of-band. If the message asks for money, credentials, or secrecy, confirm it through a channel you already trust (Slack DM, phone, in person) — not a reply to the email.
- 3.Report it. Even one real report helps IT pull the campaign from everyone else's inbox before it spreads.
Pattern: mfa_prompt · trend tag: 2026-Q4-MFA-fatigue