Why securing your email is the most important step after a phishing attack — and why most people skip it