Good news: nothing happened. This was a safe training exercise from your security team —
no credentials were captured and nothing was installed. But a real attacker's email would have looked just like it.
You're not in trouble. Clicking happens to smart, busy people every day — that's exactly
why we practice. There's no penalty and no name-and-shame. What matters is what you do next.
▸ The hero move: report it — it still counts
Even though you clicked, you can still win this one. Report this email now and you'll
earn the event's top “Reach the Recognizer” bonus.
Use the “Report” button in Outlook (Report phishing), or forward it to secops@deseretmgt.com.
You'll get a confirmation, and the 300-point bonus is added to your score after the competition closes. Fast reporting is what stops a real breach.
What gave it away
Lookalike sender domain — deseretmanagementverify.com, not the real deseretmanagement.com.
The link's domain wasn't ours — deseretmanagementverify.com, not the real deseretmanagement.com. Always hover (or long-press on mobile) to see where a link really goes before you click.
Urgency + fear — a same-day deadline and a threat to suspend your access, to rush you past thinking.
Credential re-verification pretext — real IT won't email you a link demanding you “re-verify” your password under a deadline.
The rule that beats all of these: verify out-of-band — if a message pressures you to act,
confirm through a channel you already trust (the IT number on the intranet, in person) before you click — and
report anything that feels off. Verify. Report. That's the whole game.