> Security training is ineffective against phishing attacks like this.

I wouldn’t say that. There’s a significant effect of training on the number of people that click. The big problem is that the attackers have to only get it right the one time.