Anyone else ever notice that corporate security training usually follows every sin that corporate security training tells you not to commit?

-Usually comes from a strange domain
-Usually sends you to an off-domain website
-Usually needs you to enter your credentials into that strange website