You get an email from your “CEO.” The tone is right. The project names are right. No weird grammar, no obvious typo, no suspicious attachment named invoice_final_FINAL.zip. It asks you to update vendor bank details before lunch.
A year ago, the advice was to look for mistakes. Today, AI can write a cleaner phishing email than half the real messages in your inbox. So the fix is not another scary training video where everyone promises to be more careful.
The better fix is boring in the best way: phishing-resistant authentication, multifactor authentication, browser-level warnings, and password manager phishing protection that quietly says, “Nope, I’m not filling your password here.”
Why “spot the bad email” is no longer enough
The old phishing playbook assumed the scam would look a little off. Bad spelling. Strange formatting. A sender address that looked like it was assembled during a power outage.
AI changed that. A fake payroll email can now sound polished, specific, and calm. It can reference a real project, mimic a leader’s tone, and create just enough urgency to make you click before coffee kicks in.
Google reported that phishing and credential theft drive 37% of successful intrusions, and email-delivered infostealers rose 84% in 2024. Infostealers are especially ugly because they do not just grab one password. They can take browser sessions, cookies, autofill data, and anything else they can reach.
That means the goal is not “never click a bad link.” People click links. The goal is to make a bad click less catastrophic.
Passkeys explained: the login that fake sites can’t reuse
Multifactor authentication, or MFA, means a site asks for something beyond your password: a code, a push approval, a security key, or your device.
CISA says accounts using MFA are 99% less likely to be hacked. That is a huge upgrade, even if not every form of MFA is equal. SMS codes are better than nothing, but text messages can be stolen or tricked out of you. App-based codes are stronger. Push approvals are convenient, but “approval fatigue” is real when attackers spam prompts until someone taps yes.
Passkeys are the cleaner version. There is no password to type into a fake page. No six-digit code to paste. The secret stays on your device.
Think of a passkey like a lock that only opens for the real website. A fake door can copy the paint, the handle, and the welcome mat. The key still will not turn.
Google says passkeys are generally available to more than 11 million Workspace customers, and Workspace sign-ins are 40% faster than passwords. That speed matters. Security tools fail when they make everyone miserable. Passkeys usually feel like unlocking your laptop: face, fingerprint, device prompt, done.
Your password manager already checks what your brain misses
Here is the everyday phishing moment: you click a convincing payroll link. The page looks familiar. Your brain says, “Fine, just sign in and move on.”
This is exactly where willpower fails.
A good password manager checks the website address before it fills anything in. If you saved a login for your bank, it should fill only on the real bank domain, not a lookalike site with the same logo.
That tiny refusal is powerful. Your memory recognizes colors and buttons. Your password manager checks the address.
Dashlane, 1Password, Bitwarden, and iCloud Keychain all do some version of this. The habit to build is simple: if a login page looks right but autofill does not appear, stop. Check the address manually. Do not copy the password out “just this once.” That defeats the whole point.
Where Dashlane Omnix and AI phishing alerts fit
Dashlane says Omnix AI phishing alerts analyze more than 75 webpage attributes inside the browser extension and warn employees in real time. That is useful because the email may look harmless. The real trap often appears after the click, on the credential-harvesting page.
Dashlane also says its Smart Extension can protect employees who do not have a Dashlane vault, if the extension is deployed on company devices. That matters in messy workplaces with contractors, part-time staff, shared machines, and people who were somehow left out of the neat security rollout.
I would treat this as a seatbelt, not autopilot. Helpful, especially for teams, but not a reason to click everything confidently.
If you manage a team, ask vendors three plain questions: what data leaves the device, how long is it stored, and who can see it? Browser-level protection sees context, so employees deserve plain-language answers.
Pilot it before a full rollout. Use people who actually receive risky emails: finance, HR, executive assistants, sales, and anyone handling vendor documents. Track useful warnings, false alarms, and whether people understand the next step. “Danger” is not enough. “Close this page” or “verify this domain” is better.
The practical checklist for this week
My ranking for normal professionals is simple: passkeys first where available, MFA everywhere, password manager always, browser warnings on, AI alerts for teams.
Start with email. If your email account falls, password resets for everything else become attacker tools. Then protect your password manager account, payroll, bank, cloud storage, accounting tools, and domain registrar.
For teams, write a one-page policy in plain English. Which accounts require MFA? Who approves payment changes? Where do employees report suspicious links? No payment change should happen from email alone. Use a known phone number, a trusted Slack contact, or a vendor portal — not the number in the suspicious email.
AI made phishing more polished. Your defense does not need to be dramatic. It needs to be layered, boring, and hard to bypass.
Try one passkey this week. Notice how ordinary it feels. That is the best kind of security: strong enough to work, easy enough to keep.
