This one time I got a “test email” but it was sent from a legitimate domain, used our in-house style correctly, didn’t contain any spelling errors, contained personal information about me that a simple leaked email couldn’t reveal, and linked to a document on an internal server. When I opened the link, it said “this was a mock phishing email, your respone has been registered”. Literally the only time I got got, and their supposed “tell” was that the tone was more urgent than you’d expect. I just thought it was written by a stressed intern.