We've been on the receiving end of these attacks lately. Strict SPF policies, DKIM, and a restrictive DMARC policy can help ward them off. As a matter of polic

We've been on the receiving end of these attacks lately. Strict SPF policies, DKIM, and a restrictive DMARC policy can help ward them off. As a matter of policy, our team uses LastPass, too, which makes phishing easy to detect; if LastPass doesn't offer to fill your login info, you're not on a legit site. Using LastPass-generated passwords that users can't remember on their own is a marvelous anti-phishing weapon. We also enforce 2FA. That said, there is no substitute for education.