Plus, many companies outsource many services to some SaaS third party, like payments, order tracking, even inventory and other stuff. They come with funny domain names and it's borderline impossible to tell what's legit and what's not.

And now I should tell my 70+ year old mom to "always look at the url bar"? That's entirely useless.