In a small office, most account takeovers start the same way: one person gets an email about a shared file or an unpaid invoice, clicks, and types their work password into a copy of the Microsoft or Google sign-in page. Here is what actually stops that step, roughly in order of cost, with what each option misses.
Training helps people notice the email. It doesn't help much at the moment that matters, which is when a convincing page is open and someone is halfway through typing. The options below act at that moment or make it harmless.
This is the strongest fix for the account itself. A passkey is bound to the real domain, so a fake page on any other domain can't use it. It also beats the relay kits that get past text-message codes and push approvals by capturing the session after sign-in, which Microsoft has seen used against more than 10,000 organisations.
What it misses: only accounts that support passkeys, and only once everyone has enrolled. It does nothing for the payroll portal, the bank, the supplier's invoice site or a card number typed into a fake checkout.
Password managers fill a password only on the domain it was saved for. On a lookalike page they stay silent, and "my password manager didn't fill this in" is a better warning than anything a person can spot by eye. Tell staff that in exactly those words.
What it misses: people who type the password by hand when autofill doesn't appear, which is what most people do.
SafeBrowsingProtectionLevel = 2) and Microsoft Defender SmartScreen in Edge (policy SmartScreenEnabled). Both block pages on Google's and Microsoft's lists of known phishing sites.PasswordProtectionWarningTrigger with PasswordProtectionLoginURLs). Chrome warns when someone types the company password on a site that isn't on your list of sign-in pages. Google's Password Alert does the same for Google Workspace passwords.What they miss: blocklists only know a page once it has been reported, and new phishing pages are often used within hours of going up. The reuse warning covers the one company password, in Chrome only, and fires after the password has been typed.
Microsoft Defender for Office 365 (Safe Links, included in Business Premium) and similar filters check links again when they're clicked, not only when the email arrives.
What it misses: links that arrive another way, such as Teams chats, WhatsApp, text messages, QR codes and personal email opened on a work laptop, and pages that only turn malicious after the first check.
The last chance is the page. A browser extension that looks at the login page as it loads can catch what the other layers don't. Typical signs are a domain one letter off from the real one, or a Microsoft-looking form whose password field sends to a different server. It doesn't need to know the page in advance, because it judges the page, not a list.
This is what we build. PhishClean runs its checks inside the browser and warns before a password or card number is typed into a phishing page. Nothing about the pages people visit leaves the device. For an office, IT installs it by browser policy (Google Admin, Intune or Group Policy), so there's nothing for staff to set up and no individual upgrade prompts.
What it misses: an extension only protects browsers it's installed in, so phones need passkeys and the habits above. No page check catches everything, which is why it belongs on top of the free settings, not instead of them.
Isn't phishing training enough?
Training makes people more careful with email, and it's worth doing. But the pages are now good enough that careful people still get caught when they're busy. Treat training as one layer and put a technical check at the login page too.
We already have MFA. Why would anyone still lose an account?
Phishing kits now relay the real sign-in page, including the MFA prompt, and keep the session the real site issues afterwards. Text codes and push approvals don't stop that. Passkeys and security keys do, because they only work on the genuine domain.
Can we deploy a browser extension without touching every laptop?
Yes. Chrome and Edge extensions can be force-installed from Google Admin, Microsoft Intune or Group Policy (the ExtensionInstallForcelist policy), and Firefox from policies.json. Staff see it appear after the next policy refresh.
Does a phishing extension see what my staff browse?
It depends on the product. Some send every URL to a cloud service to be checked. PhishClean analyses pages on the device and doesn't send browsing data anywhere. The source code lists every network request it can make.
PhishClean for Teams is $5 per user per month (minimum 5 users), rolled out by browser policy. The pilot is free for 30 days and needs no card.
Ask about a team pilotLast updated:
If this helped, share it with someone who would benefit from it, or subscribe for new browser-security guides from PhishClean.
Get practical phishing and browser-safety articles in your inbox. No salesy drip, just new guides and product updates when they are worth sending.