The funniest example I have, an external audit company sent an email to everyone in the company with a spoofed sender address matching a colleague of mine. The subject line was about how much another colleague had earned in commission, and the body contained a link to an obviously dodgy looking domain.

Naturally half the sales team opened it and clicked the link because statistically at least half of all salespeople are greedy idiots. In their defense though, we had a good email filtering system in place at the time so they had a reasonable expectation that all emails would be from who they said they were from, and that a dodgy link would have caused an email to be flagged as spam.

However, that email filtering system was the product they were selling. Every one of those people knew what sender address spoofing was. They all knew what risks are associated with clicking random links. They had discussed those dangers with hundreds of customers. And they still failed the test. Their jealousy or curiosity overrode everything else.

I don't know what action was taken to prevent a repeat occurrence, but I think the people were so embarassed that not much action was required.