Oh man, this is so real. My 5 year old dropped some nonsense about a cow riding a skateboard and I was crying laughing, and then I felt bad because I had been fake laughing at his other jokes for months. Here is the trick I learned though, don't just nod and smile at the bad ones, ask her to explain them or make up a new ending with her. That keeps her going and you get way more of the random silly ones that actually land. Also write the good ones down in your phone, because you will forget them and they are gold later.

The "look for bad grammar" thing is the worst advice because half these fake emails now are written better than the real ones. My rule is I never trust the display name, I hover over the link and read the actual address it points to, and if the domain is a bunch of random letters or ends in something weird I just don't touch it. You can also copy the link and paste it into a site checker like VirusTotal or urlscan before you click anything, that takes ten seconds. For the browser thing, turn on Google Safe Browsing if it isn't already, it blocks a ton of these pages and screams at you before the login screen loads. The big one for your office is that your boss needs to stop clicking, so at the meeting push for two step login on the client portal so a password alone can't get anyone in.