It turns out that halfway clever phishing attacks really, really work

[drpfenderson]

2-factor auth + autofill password manager (also with 2-factor auth), means you get to mostly dodge these.