The phishing attempts our IT team sends out to test how vulnerable we are as a company always had some spelling mistakes. You can always hover over the the links before you click them and see if they actually lead to the website of the company they're supposed to be from, or whether they have a really long weblink to something fishy. If you know how to navigate to what you need, don't click links in mails at all.

You can also click the sender. Usually the sender of a phishing mail will have chosen a legitimately sounding "name" like 'Fed Ex Customer Service' but once you click that name the mail details you'll see the actual mail address it's sent from and it usually becomes pretty obvious whether it's really from that service or not. If they don't have the company they're from in their email domain (everything after the @) don't bother opening it. If it's a really long email address, also probably fake.

But even when it seems to be a real address, they could catch you by using Cyrillic characters instead of latin characters in their domain name. These look pretty much the same, but they often lead you to a very identical website and want you to fill in passwords and other sensitive information that they then get to see and use.

Golden rule, especially at work: don't click anything not work related. There's no reason you'd need to click a fed ex link on a work computer or on your work mail address (if the order isn't work related). Anything that seems too good to be true, like winning lotteries you never participated in, getting tax returns (again: why would you see that mail on your work account?), getting packages you never ordered... probably are too good to be true.

Also be careful with mails that try to scare you into immediate action. If get mails that tell you some account will be blocked or deleted if you don't click the link, and you have no idea what it's about. If it makes you curious and maybe emotional, assume that there's a malicious reason why they'd want you to click the link. Use your browser to manually go to the website they claim to be representing (if it's something you were already familiar with!) and use the customer support there to check whether you really are in trouble with something. Maybe ask if you can forward the email to an address the company uses to handle phishing attempts in their name so they can warn customers not to fall for these tricks.

You can always report phishing or spam mails once you've opened them. But preferably, if you can already determine it's spam or phishing: don't even open the mail. Some of them just measure whether the phishing mails get opened by having a tracking pixel send back data to the sender about the time of opening and possible location and a few other details. They want to see who opens these mails and by doing so, determine which mail addresses are actively used. Then then sell lists of active mail addresses to other scammers because those are worth more since there's a higher chance to actually be able to scam people that way.

If you use at least some of these tips, you'll be a bit safer. I also suggest you don't see these training courses about online safety as a "punishment" for failing the test. They pretty much teach you what I've tried to write down here in response to your desire to want to know how to be safer online.