Spear phishing is remarkably effective, even against tech-savvy people. One of the most alarming aspects is that we've become trained to click links in emails a

Spear phishing is remarkably effective, even against tech-savvy people. One of the most alarming aspects is that we've become trained to click links in emails as soon as we see some trustworthy indication, be it something we were expecting, a spoofed sender or copying Google's layout, further re-enforced by an accurate login page clone. I think the best defence here is to condition ourselves out of this behaviour. If you receive a link in an email, don't click it - view the source or paste it into a text document and examine it. And if you aren't expecting an email, such as Google emailing out of the blue, go to the known-trusted site and see if there's any pending notifications. Seems we need to stop trusting email.