This was a safe simulation
No real harm was done. Your IT & Security team sent this on purpose so you could learn to spot the next one.
Nice catch — this was a simulation.
The sender domain was acrne-finance.com (note the r/n swap), not acme.com. In real life, verify out-of-band.
Three habits that would have caught this
- 1.Hover before you click. Your email client shows the real destination domain in the lower-left. Look for it. A single-letter swap is the giveaway.
- 2.Verify out-of-band. If the message asks for money, credentials, or secrecy, confirm it through a channel you already trust (Slack DM, phone, in person) — not a reply to the email.
- 3.Report it. Even one real report helps IT pull the campaign from everyone else's inbox before it spreads.
Pattern: invoice · trend tag: 2026-Q4-finance-invoice-pretext