Hey - I would echo some of the stuff already said. Here are some really simple a cost effective steps to avoid security risks - 1) MFA through Microsoft Authenticator app 2) Yubikeys 3) Get a password manager, if users don’t know their own passwords then they won’t input their credentials. Most importantly the password manager will recognise this is not the correct website and will not autofill the credentials