I blocked these emails for years for this reason. We actually do get real phishing attempts about once every other month when a client gets compromised. Makes everyone at our company very vigilant.

Management got pissed when I hadn’t done any of them. Apparently, the emails in english/spanish/french with “click me” links were legit, lol. I set up extensive rules and blocklists for a reason. Pretty sure it’s for SOC2 compliance or something.