Protecting against phishing emails is largely in the hands of the email service provider. Email service providers spend a great deal of resources trying to detect spam and malicious emails - you can help them protect your users in a couple of ways.