Training is one thing - but many workers many fail to spot the difference when it comes to phishing scams.