I think you just have to distrust email (or any other "pushed" messages), period. Just don't ever click on a link in an email or a message. Go to the site from your own previously bookmarked shortcut, or type in the URL.

I got a fraud alert email from my credit card the other day. It included links to view and confirm/deny the suspicious charge. It all looked OK, the email included my name and the last digits of my account number.

I logged in to the website instead. When I called to follow up I used the phone number printed on my card.

Turns out it was a legit email, but you can't really know. Most people don't understand public key signing well enough to rely on them only trusting signed emails.

Also, if you're sending emails like this to your users, stop including links. Instead, give them instructions on what to do on your website or app.

There is companies that send email with invoices where you have to click a link. There is no way of logging in on their site to get to the invoice. It is an easy fix for them (we use the same invoicing company as they do so I know). All they need to do is click "Allow sending bills directly to customers bank". Every month I get the email, I use the included chat function on the webpage to ask when they will enable this and it's always not possible. Mabe some day.

I wish we could stop training people to click links in random messages just because we want to be able to track their movements online.

I get Coinbase SMS all the time with a code not to share. But also… “call this phone number if you did not request the code”.