So much for counter-phishing training: Half of people click anything sent to them