We send out fake phishing emails, i.e. they’re not really phishing emails but they are designed to look like them to see which people in our organization click them.
Often we will just copy and paste a real one so they look exactly like the real thing and there’s always some pillock that clicks them and enters their password or something into an obviously fake form. Then when you challenge them on why they were fooled by such an obvious ploy they always say something like “oh I don’t really do computers” as if that’s an excuse.
And it’s always the people you think it’s going to be. The ones that call up to tell you that their computer is running slow and invariably it’s because they have 945 Chrome tabs open.