Your users need regular training on how to spot security threats as well as how to avoid identity theft.