> Now the customer has two domains and we have been training users to look for signs of phishing attempts using look alike domains AND ask them to put in their CC to buy things

They already have to do that, only currently they have to put it into customername.shop-saas.com, not customername-shop.com, or even shop.customername.com.