iiiiiiitttttttttttt

This likely had several warning signs that can be used for even personal emails. 1) is it too good to be true? Definitely in this example. Give me a gas card physically and I might believe it. 2) look at the actual link before you click. If it's not part of the main domain for the company you're expecting, or not within the intranet at work, it's an automatic nope. 3) any oddities in the message or images that seem wrong. Misspellings, pixelated logos, etc. This is the smallest red flag, as often times getting a perfect email without any grammar or spelling issues means it didn't come from a manager, that seems to be a requirement.

phish tests are redundant after a point. I flagged the first few but they upped the frequency so much it got ridiculous. Turns out the header for the phishing tests all contains the name of the testing company. New phish tests are re directed to my brownie points folder, so I just have to worry about the real thing now

All emails get automatically forwarded to the IT department, for "suspected phishing". If it is from a known internal source, especially so.

I think this story may be told by an unreliable narrator.

We have no evidence that the email actually came from their job - that misidentification by Ki might be the problem that IT hopes training will solve.