Gordon is a new manager$-$level employee at HCL$.$ One week after starting his position, he receives an email that appears to be from "The IT Support Centre" which requires that he verify his "company password" is strong enough as a new employee.

The email has a link that takes Gordon to an HCL$-$branded page with a form to enter his email address and password so it can be verified. Gordon wants to make sure his passphrase is strong, so he fills out the form.

Connected to his position, Gordon has already been added to a OneDrive folder that contains restricted institutional data. What is the outcome of this situation?

$$ Gordon safely verified the strength of his password.

$$ Gordon gave up his HCL email address and passphrase to the scammers. They now have his username and passphrase for all his HCL services that use those credentials.