I call a victory the fact that he's asking. I've seen the consequences of people just clicking and when you tell them what they did wrong they just blatantly lie to my face
This, so much this! We have been on a year long plan sending test scam emails to our staff. We still have 5% who will click on anything. Sometimes I think they do it intentionally so that they can avoid work by being required to take email security training. I'm lobbying management to start writing up chronic offenders.
Our policy states that after enough offenses we take away their email. Like here's your pen and paper, hopefully our customers like your correspondence and your penmanship is good.
Exec after you tell him that yes, it's definitely a scam: "I once knew an Esther McScamface...you're sure I shouldn't just click that blue thingy at the bottom?"