Pause · Verify · Report

This was a phishing simulation.

You followed a link in a simulated Diwali Gala invitation. This controlled awareness exercise demonstrates how a realistic event invitation and RSVP form can be used to encourage quick action.

Learning point: There is no blame in making a mistake during an exercise. Use the warning signs below to help spot suspicious messages before sharing information or following links in the future.

Campaign review

What was in the email?

The message presented an “Annual Corporate Diwali Party 2026,” with a date, time, venue, dress code, dinner and entertainment details. It asked recipients to confirm attendance by the end of the day and directed them to an RSVP form.

1 · Look-alike domainOne character changedThe simulated sender was hr@campussh0es.com. The character after “sh” is the number zero (0), not the letter “o” used in campusshoes.com. Always inspect the complete sender address and actual link domain.

2 · Urgency“End of the Day” deadlineThe invitation asks for confirmation by the end of the day to create pressure to act quickly. Urgency is not proof of phishing, but it is a reason to pause and verify.

3 · Familiar business contextHR and employee event themeA Diwali party, leadership mention, transport, food preferences and an employee RSVP can feel routine. Familiar branding and plausible details do not establish that a message is genuine.

4 · Personal information requestEmployee details on the RSVP formThe form requested full name and employee ID, plus attendance, dietary preference, transport details and an acknowledgement. Before submitting workplace information, verify the request using a trusted internal channel.

Form review

What should you notice before submitting?

The form requests a full name and employee ID. Treat employee identifiers as workplace information and share them only through verified, approved processes.
It asks for dietary preference and shuttle requirements. These may appear reasonable for event planning, but a plausible purpose does not verify the sender or website.
The form displays hr@campussh0es.com as a contact address. Do not use contact details supplied in a suspicious message to validate that same message; use a known internal directory or trusted channel.
A polished page, logo, HTTPS connection, or familiar visual design is not by itself proof that a website is legitimate.

Important distinction: The supplied HTML form handles submission in the browser and displays a confirmation message; the source code does not show a backend request that sends form entries to a server. Do not assume the form actually records or transmits responses just because it displays “RSVP Received.”

What to do next time

Pause, verify, report

1. PauseDo not click immediately when an invitation, request or deadline arrives unexpectedly. Avoid entering credentials, employee details or other information until you verify the request.

2. VerifyInspect the full sender address and link destination. Contact HR through a known internal directory, company portal or previously verified contact method.

3. ReportUse your organisation’s approved phishing-reporting button or report the message to IT/Security, even if you only suspect something is wrong.

If you already clicked

Take the appropriate next step

If you only opened the page, close it and report the email according to company procedure.
If you entered a password or one-time code, contact IT/Security immediately and follow their account-protection instructions.
If you downloaded or opened a file, report that promptly and follow the security team’s instructions.
Do not feel that you must hide a click or submission. Early reporting helps the security team assess and respond.

Remember

Familiar-looking is not the same as verified.

Check the sender, inspect the destination, verify unusual requests independently, and report suspicious emails. A short pause can prevent a much bigger incident.