Theory
Phishing resistance belongs in the credential
Origin-bound, hardware-backed authentication removes a whole class of failure regardless of how convincing the message was. This is the clearest available example of design beating vigilance.
What phishing-resistant authentication covers
Claim: inference
It addresses credential capture and replay. It does not address session token theft, consent phishing against applications, social engineering of help desks, or payment fraud that never touches authentication.
The research interest is in what attackers do next once this path closes, and whether total loss falls or merely moves.