Education has to go both ways, though. Sure, employees and users need to to know the dangers (for instance - Facebook users need to know how dangerous it is to give Facebook the password to their email accounts) but Facebook thinks it's dangerous for it's users to understand security.

The first time I ever saw a Phishing scam on Facebook I took a screen shot and emailed it to Facebook, because I was almost certain that Phishing was not occurring on a large-scale on their web-site at that time. The result? They blocked my account for almost a week. I guess the fact that I knew what a Phishing scam was made me "suspicious".

If the IT department where I work called me and asked for my password, I would hesitate to refuse because odds are, they'd think I was trying to hide something. They honestly wouldn't understand why it was a bad idea for me to give them my password.