Even worse, they sometimes try really hard to be indistingushable. I recently got a mail from an insurance company that they were upgrading the login method (r

Even worse, they sometimes try really hard to be indistingushable. I recently got a mail from an insurance company that they were upgrading the login method (red flag). The domain in the link contained wasn't the main domain but a separate customer service domain (red flag 2). And the main login didn't work as expected before clicking the link in the mail (at least that redirected to the main domain). It really can't get much worse.