I believe we’re making the same point from different angles: I’m pointing out that companies I work with don’t exhibit easily identifiable characteristics to v

I believe we’re making the same point from different angles: I’m pointing out that companies I work with don’t exhibit easily identifiable characteristics to verify authenticity. You (correct me if I’m wrong) are stating that bad actors will craft messages that look like legitimate ones. In either case, we end up in a place where I would be unable to determine if a message is legitimate barring further out of band confirmation.