Some hackers exploited two factor authentication recently by playing on this exact impulse.

Sent a message that looked identical to the two-factor notice and got people to reflexively turn over their private keys.

People see the word "phishing" and automatically remember that phishing mails exist, so their first reaction is to report them, not read them.

Had to setup a fake phishing system as well.

Before the training was setup, people rarely reported mails. But the moment we send out mails about the phishing training, a ton of those got reported.

If phishing mails actually told you they were phishing, we wouldn't need training.

It is considered a fail, and then inputting passwords in the form is a super fail.