Education helps, but it puts the burden on the user. The real fix is shutting down the phishing source, not just filtering the symptom.