Don't worry, nothing you typed was saved, and there is no Christmas
form. This was an internal security awareness test.
A few things that gave it away:
The sender domain was shr-haarlem.com (not the real srh-haarlem.com).
Google Forms never asks you to log in again to fill in a form.
The urgency around a “secret present” is a classic nudge to make you click quickly.
Next time: check the sender domain carefully, and never re-enter your
password on a page you reached from a link. When in doubt, forward it to IT.
One small favour: please keep this to yourself for now — don't share it or
warn your colleagues yet. We'll talk it through together at the next team lunch.
