At my work the company wanted to show some gratitude and sent out email with free ice cream vouchers to everybody. Many suspected this was just another one of these cybersecurity email tests, so the company had to clarify it’s all real.
I think it’s hilarious the thought about hackers using ice cream as bait. Maybe that would work?
The place where I work does these regularly, and you get slammed hard if you fall for one, and frowned at if you don't use the "Report Phishing" button on them.
But the knuckleheads contracted testing out to a company that always sends the tests from the same domain.
So anyone even the slightest bit savvy about spam/phishing/email headers can set an Outlook rule to dump test emails to a special folder and pop an alert.