I just take it one step farther and never open any email. If it’s important you will CC my manager and he will physically come by my office and tell me about the email, giving me multi-factor phishing protection. If he demands I open an email then I am absolved of responsibility.