Good job on catching this before it got too far. I work for a vocational college that happens to own a Cyber Security firm. We get routinely fished by these guys all of the time, and it is very good because they are not over seas, so the English at least is perfect.

Often the fish is from our boss or management, click on a link and you are directed to a website that says you were busted once again and to refer to your checklist of thinks to look at.

We all had to take a course and Phis our instructor as an assignment, I did pretty good and was surprised at how easy it was to do, with a bit of time and would probably be exceptional with the tools that I learned to use in this course. I did take mine a level above though using a legitimate looking email address rather than just hiding an address below a fictional display name, a level above anyone else in class and "too easy to do". and also free.