Phishing without guesswork — practical training in recognising, safely verifying and reporting phishing attempts.