No mention of password managers yet? One of the major benefits is the password manager can do a quick, simple, completely deterministic check on the domain before providing the password. That would have stopped this dead in its tracks without relying on the human just happening to notice.

I personally use bitwarden on my chrome profile across Windows Mac Linux and android and think it's great. Highly recommended.

Of course I tell this to family and friends and no one does it so I dunno...