This was a safe simulation
No real harm was done. Your IT & Security team sent this on purpose so you could learn to spot the next one.
HR pretexts are up 30% this quarter.
HR mails come from acme.com, not look-alikes. Always route through the HRIS, not an email link.
Three habits that would have caught this
- 1.Hover before you click. Your email client shows the real destination domain in the lower-left. Look for it. A single-letter swap is the giveaway.
- 2.Verify out-of-band. If the message asks for money, credentials, or secrecy, confirm it through a channel you already trust (Slack DM, phone, in person) — not a reply to the email.
- 3.Report it. Even one real report helps IT pull the campaign from everyone else's inbox before it spreads.
Pattern: hr_benefits · trend tag: 2026-Q4-HR-benefits-season