Training is one thing – but many workers many fail to spot the difference when it comes to phishing scams.