I think some Cyber Security team is always facepalming when someone falls for the simplest phishing attack. You won a competition you never entered? You signed in & authorized an app via SSO?