Meanwhile, employees tend to be overconfident in their ability to detect scams.