| > Train your users where it is and isn't safe to enter credentials. This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing. > Don't give your users credentials. Have some alternate way to authenticate them like a login token. Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a university, no matter how famous. > Put rate limiting on the ability of a single account to send out emails. Many users have legitimate reasons to send out mass emails. > Instead of blocking the site that was collecting the credentials, a better solution would have been to remove the email from the mailboxes of all the students. Phishing emails are often varied into multiple templates to avoid being scrubbed this way. They also tend to trickle in at random, rather than turning up all at once. |