01
Unexpected request
The message asked you to confirm attendance and share employee details without a prior notice through a known internal channel.
Dear colleague, the Diwali celebration lunch message was a simulated phishing email. A convincing invitation can create urgency and encourage quick action. This is a learning opportunity, not a punishment.
The simulation has now ended
Do not enter or submit any additional information on this page. Your interaction may be recorded only for the authorized awareness exercise and its reporting process.
Red flags in the simulated message
Several clues could have helped identify the email before clicking its registration link.
02
Artificial urgency
A respond-by date encouraged immediate action instead of giving you time to verify the invitation.
03
Link verification
Hovering over the button, or checking the sender address, would have shown that the message did not come from manipalhospitals.com.
04
Request for personal details
The page asked for your name, employee ID and mobile number. Identifying details should be entered only after you have verified the request independently.
05
Trust through branding
Logos, polished formatting and familiar terminology can be copied. Professional appearance alone does not prove authenticity.
06
Independent verification
The safest response was to confirm the invitation with a known HR or security contact, rather than using the link in the email.
What to do next time
Pause
Be cautious when a message creates urgency, fear, curiosity or an unexpected benefit.
Verify
Check the sender, inspect the link destination and confirm the request through a trusted channel.
Report
Use your organization’s approved phishing-reporting method so the security team can investigate quickly.
Remember: stopping for a few seconds to verify an unexpected request can prevent account compromise, data loss and wider organizational impact.