There needs to be a way to send out emails like this to all employees in a company and track who falls for it. Then training for the dangers of phishing will be much more effective. Of course you wouldn’t record what they actually enter in the fake form but simply redirect to a PLEASE REPORT TO HR IMMEDIATELY page.