Are you building features for phishers? (opens in new tab)

I do this and have been teaching my family too. Recently, my daughter got her Roblox merchandise emptied after she clicked a link from Discord. I looked and rough math put at close to $1000 worth of Robux (when converted if I have to buy the Robux). This happened after she figured out to turn off all ad-blockers, NextDNS, from the client side. Now, I have migrated the VPN-ish-DNS at the Profile Config level and have told here that the blockers in the browsers are for her safety. She cried the whole day, until I agreed and bought her few Robux to go on.

Phone calls and text messages are the ones I have no control whatsoever, so I try to avoid them at all cost, not just for security but they are irritating most of the times. I stopped voice few years back - https://no.phone.wtf

> Never click the link in an email to access your account

Now that you mention it, I noticed that I do this routinely. How do I handle "reset password" situation? I don't remember if the services I have used offer other means of going to the password reset link.

Defense in depth is a worthy goal though

You'll never get 100% of people remembering that advice 100% of the time. So how do you mitigate the situation when they forget?

Unfortunately people cognitively decline to the point they can't apply these rules.

You get people calling with "your son is in jail and you must buy these gift cards at Target" and it works some of the time.

Good sentiment but so so tricky to get the wording right. You've got to write a sentence so perfect the fraudster can't pervert it or persuade the victim to ignore it.

For your example, the fraudster could say "yes, your account is being targeted by criminals, that's why I'm calling you". The warning inadvertently backs up their story