Will financial institutions ever learn that one of the biggest ways to combat phishing is to _never send an email from a domain that is not the domain the customer logs into_? Email from Schwab, but it's from proxyvote.com, with links to broadridge.com for an annual report.

This looks scammy as hell. But I did my digging and it's all legit. Why do institutions do this?