company fell for because it was about "annual reviews" right at the same time we were doing actual annual reviews. Now employees are flagging many more emails as suspicious (even ones that are almost certainly legit just to be safe) since then and IT complains about it.