I once ordered some software from our internal catalogue, then got an email from some external address I didn't recognise with a download link that seemed fishy as hell. Except we don't get admin permissions on our (company-provided and -managed) devices so I couldn't even have installed it if I wanted.

Reported it, got told "Yeah, nah, this is legit. You're supposed to download it and have support remote in and install it for you. It's all in the product description, if you read it." In hindsight, maybe the lack of any corporate logo or other attempt to make it look credible should have clued me in, reverse-psychology style: If they really were trying to trick me, they'd have put at least some effort in, right?