My little hobby is reporting any and all emails about compliance, training, etc (basically anything with actions in them) as phishing and then escalating their responses as "social engineering". It's fun!

Im in the security alias and that happens unironically every time the company rolls out a new external service.

Now sketchy emails are preceded by an equally sketchy “it’s ok” email from IT.