I talked to my company today and told them how phishers use a sense of 1) danger, and 2) urgency, to push smart people to do rash things. I offered to be their personal, confidential fear consultant: “hey, I got this scary thing. Is it real?” Let me do the worrying for them.
This, more than goofy phishing tests that make people feel dumb, is how we help our friends avoid scams.