I think people learn to follow whatever their browser does, assuming they bother to notice in the first place. I wouldn't worry as much about how to get people

I think people learn to follow whatever their browser does, assuming they bother to notice in the first place. I wouldn't worry as much about how to get people to notice security, browser vendors are on the right track by popping up giant notices for insecure sites and sites with malware. They just need to extend the "untrusted download" concept from operating systems to email where you could have "untrusted link" warnings in your browser instead. "Are you sure you want to visit paypal.28753272.server? You really shouldn't trust this link..."