MSG Promised Workers Knicks Championship Rings in a Phishing Test and It Backfired in Public

The bait was sports history

Madison Square Garden became, in Morning Brew words, the final boss of phishing email tests. The venue home to basketball and hockey sent an email to employees in September telling them they were getting Knicks NBA championship rings. Anyone who clicked the phony link did not get jewelry. They were required to take a cybersecurity class, The Athletic reported.

The bait was believable, which is why it stung. Teams usually give rings to players, coaches, and front office staff, but occasionally distribute them to more employees, so workers could hope the email was real. A test that makes a generous gesture look fake teaches employees to distrust good news from their own company.

The apology came with real rings

After the news broke, an MSG spokesperson told the New York Post the company is gifting more than 275 championship rings and jewelry to players, coaches, employees, and other members of the Knicks family. The spokesperson said that was always the plan, and called using the rings in the faux phishing email an unfortunate mistake.

Read those two facts together. The fake promise damaged trust badly enough that the real promise had to be announced in public the next day. Whatever the test was supposed to teach about email safety, the lesson employees actually received was that management would fake a once in a lifetime gift to catch them clicking. Morning Brew gives the section a fitting title question: why would I deceive you.

The research is not on trick tests side

Many companies embrace phishing simulations as a cybersecurity measure, but their effectiveness is up for debate. Google security manager Matt Linton made a high profile case in 2024 for why tricking employees in the name of improving security does not work and can even have harmful side effects.

Critics note that these exercises do not simulate what a real phishing attack looks like in an inbox. The feeling of management trying to trick workers can lead to resentment. Repeated tests can also erode the trust needed to make systemic improvements, and lead to inaction when a real threat arrives. The numbers back the critics: an eight month study involving nearly 20,000 healthcare workers last year found no significant relationship between whether users had recently completed annual mandated cybersecurity training and the likelihood of falling for phishing emails.

What this means for a small team

Most readers here do not run an arena. They run a small business, a creative team, or a one person company with contractors, shared inboxes, and payment links flying around. Phishing is a real risk in that world too. A fake invoice, a fake booking inquiry, or a fake payment confirmation can reach the same inbox as real client work.

The MSG story suggests the defense is not deception. It is clarity:

• Agree on one channel where payment changes and bank details are confirmed, and never let an email alone change them
• Tell your team what real company messages look like, and promise never to test them with fake rewards or fake emergencies
• Make reporting a suspicious message a praised action with no penalty, so the first instinct is to ask, not to click quietly
• Train on real examples from your own inbox, with the sender tricks pointed out, instead of staging a trap

Trust is a security tool

Security advice often treats trust as the vulnerability. The MSG backlash shows the other side. Employees who trust that a strange message might be real company news, and who trust that asking about it will not be punished, are the early warning system every company actually depends on.

A phishing test that spends that trust to buy a click rate is trading a long term defense for a short term metric. The rings were eventually promised for real. The feeling of being tricked is harder to give back.