What do you suggest short of an absolute guarantee?
Common senses.
How do I advise consumers to tell the difference between legitimate e-mails with embedded links and the phished ones using spoofed sites?
What if, you go to a branch office of a bank and, in a lobby of the bank, hand a 1M USD of cash to some person whom you don't know but who claims to be a personnel of the bank?
I am concerned that this could seriously undermine the use of e-mail and websites for e-commerce and financial transactions.
Exactly.
Who said e-mail and websites are useful for e-commerce and financial transactions with absolute guarantee?
They are only as trustworthy as e-commerce and financial transactions over e-phones (note that most phones are electric).
If some reseachers of cryptography have convinced you differently, it is merely that they are more elegant in deceiving you than most spammers.
If you want to use cryptographic technology, shared secret cryptography works. That is, you share long enough secret directly with a bank and have a transaction with challenge and response authentication, the transaction is as reliable as a bank personnel you directly know.
However, PKI does not help e-commerce or financial transactions, as discussed in my recent paper: "Meaninglessness of Public Key Cryptography for Authentication on Consumable Credential" (presented in Japan in Japanese):
Abstract: For electric transactions, the essential benefit of public key cryptography over shared key cryptography is that it is not necessary to communicate with Certificate Authority on each transaction. However, it is meaningless to use public key cryptography for authentication on consumable credentials, such as authentication of remaining credential in account for electric payment, as fraud with tremendous damage is easily performed, unless communication with authorities to manage the account decrease remaining credential is required on each transaction.
The problem of PKI without realtime management of remaining credential is that an attacker can use 1K USD worth of certs from 1000 different locations for 1000 seconds 1000 times a second, total amount of damage of which is 1T USD.
Credential can be created only with direct communication.
Masataka Ohta