For me the best way to tackle all sorts of phishing is just not to do anything an email tells me to do. I will log-in online and there I will be informed if I have to do anything.
Exactly. Your approach is much better than ZA test.
I mean, I disagree with ZA test, because if users are not reading, then does not make sense to test "phishing identification skills"... by reading texts or links. Users are not reading, period.
The ZA test may give a false feeling of false skills.
It's much better your way, to train users, for example, teaching them always to visit original webpages after a message (never click inside an email). If users are mouse-clicking stuff without reading, then OK, don't read the content but stop mouse-clicking stuff... and go to the original webpage.. that's all.
www.zonealarm.com
