Anti-phishing training (and PCI in general) has made very little difference in my experience as a practitioner. Like most security remedies, there is no data to back up its efficacy, and no standard for how it should be done.