Thats why I said prevention and education. PGP prevents the user from overlooking the domain/email from where the message came. Educating users and introducing

Thats why I said prevention and education. PGP prevents the user from overlooking the domain/email from where the message came. Educating users and introducing policies (mandatory PGP, etc) minimizes the possibility of someone performing these kind of social engineering tricks. After all, people are always the weakest link, and you cant fix people :)