Any company that does that needs to be sent on a mandatory awareness training for failing an obvious fake phishing exercise. It’s far too easy to whitelist that and send it to an “ignore” folder.