A company once sent an email to all employees (about 500 of them) telling them about a holiday bonus of $650. When prompted to click on a link and fill out a form with their personal details to claim the bonus, the employees were surprised to be informed the email was part of a phishing simulation, and by filling out the form, they had failed the test.

Source: Dark Reading: Cloud