We've only sent one mass email (I don't believe it had a link in it) and I like your policy we may do the same.

The problem is if the user isn't well aware of this policy and can't tell the difference between phishing and real emails it doesn't help as much. For example AOL would put "never give out your login info over IM" on every IM window and people were handing them over right and left.

Thanks for the good feedback.

Jered