Can genericization become a credential-theft threat? Beware of phish in plain email wrappers.

The goal is for the emails to replicate internal processes to a point that it becomes highly unlikely the users will be able to determine that they are interacting with a non-legitimate request.