@babe @neil Exactly what happend with my Tax Advisor last week. Beside GDPR issues. I complained it. Next week they have set up a meeting as the seem to take my criticism serious.

Tell the companies. Most management will never know/do otherwise.

@babe I usually advise them that I didn't give permission for my address to be given to a 3rd party and it was a breach of GDPR.

Used to work well, no so much now.

@babe we constantly do this to our own employees.

Email 1: [enrolment on mandatory cybersecurity course that spends half its time warning about phishing]

Email 2: [Employer] has signed up to friendlyhorse.com to manage your travel expenses or something idk. Click here to set your password!

@babe one-upping this, our banks use different domains for some of their digital services. Alpha bank uses alphabankcards.gr instead of their official alpha.gr, piraeus bank used until recently winbank.gr instead of their piraeusbank.gr domain, and eurobank used eurocommerce.com for their payment processor. When I called them to verify if they controlled the domain the rep's response was "if it has our logo it's ours". After pressure he decided to not take responsibility and disavowed the domain (it's theirs). Btw it was using a bog standard let's encrypt cerificate.

How are clients supposed to avoid phishing?