Simplest solution: Personal Whitelists (Score 1)

>Random phonecall/email/etc... arrives >Whitelist says "You're not on the list. Credentials?" >Tries to bypass whitelist with phoney password. Every attempt gets a delayed response for security. Gets booted , nulled, or honey-potted after a few tries. >Recipient remains undisturbed. Nothing of value lost. But of course they would NEVER do this since they make money for looking the other way as this problem persists. Therefore it must be implemented at the enduser level. That way, it'd make no difference what the "service" providers do or don't do.