Phishing awareness test promised workers extra paid day off — only to reveal it was cybersecurity exercise