City employees keep entering civic credentials into look-alike captive portals while traveling. Which WLAN phishing mitigation best reduces successful credential theft?

Credential phishing against traveling city employees succeeds when staff habitually type civic usernames and passwords into look-alike captive portals on untrusted networks. The strongest practical mitigation combines ongoing awareness training, clear branding of legitimate municipal portals, and policy that forbids entering staff directory credentials on unknown or untrusted portals—users must learn to treat unexpected Wi-Fi login pages as hostile until provenance is verified. Publishing the staff PSK on laminated break-room cards expands shared-secret exposure and does nothing to stop portal phishing against Enterprise identities. Disabling TLS on the real captive portal makes legitimate pages easier to spoof and inspect, increasing rather than reducing theft risk. Collecting Social Security numbers on guest SSIDs expands sensitive-data collection without proving portal authenticity and creates privacy and regulatory exposure for the municipality. Exam caveat: awareness and branding reduce human-factor success rates but do not replace technical controls such as validated EAP server certificates on Enterprise clients; phishing mitigation is layered, not a single splash-page change. Operational check: sample traveling staff on whether they can identify the official city portal brand, verify policy language forbids civic credential entry on unknown networks, and spot-check that legitimate portals present expected TLS identity. In municipal security awareness programs, log training completion and phishing-simulation results so the wireless policy team can show continuous improvement rather than a one-time memo after an incident.