This is pretty basic, but if you're compiling a list of instructions, it include that one should not reset passwords by following a link provided in an email, but rather one should type in the URL of the website manually and navigate to the password reset page.

And companies should stop sending password reset emails with links in them. That's just priming people for phishing.