To prevent phishing, punch your employees in the face