There are 3 types of phishing emails: 1) information harvesting 2) malware delivery 3) trust abuse social engineering For 1), don't use passwords other tha

There are 3 types of phishing emails: 1) information harvesting 2) malware delivery 3) trust abuse social engineering For 1), don't use passwords other than to protect private keys,in-browser dlp protection can help leakage of other PII. Alternatively,invest heavily in MFA. For 2), there already strong mitigations like attachment whitelisting but my idea is to allow email attachments to ne saved to,written to and read from an execution restricted file path(even temp files. noexec on *nix and SRP on windows). Of course app whitelisting is ideal solution which mitigates drive-by download/web phish infections as well. For 3), don't use email for communicating trust or authorization of change. Plenty of other alternatives (mostly e2e messaging and call apps) but it is more important to have an established protocol(e.g.: call back using listed number X and confirm with another call to Y before changing banking info or transfering money).