Agent WranglersEmail security Required
Make your mail hard to fake
Never ask for a password, code or payment detail by email. Send from the same domains and addresses every time, so fakes stand out.
How to do it
Tell people in your emails and help pages that you never ask for passwords by email. Keep one sender address per kind of mail. Watch for lookalike domains, for example with certificate transparency alerts, and report them. Strong authentication makes exact copies fail (see DMARC).
How to check
Search your email templates for "password", "PIN" and "card number" in requests. None asks the reader to send one.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/phishing-resistance.