I wonder if those modest gains could have been achieved with a simple non-phishing email telling people about the risk. I also wonder if those gains transfer t

I wonder if those modest gains could have been achieved with a simple non-phishing email telling people about the risk. I also wonder if those gains transfer to real emails, or did the workers simply learn to recognize these particular fake phishing attempts.