Security Think Tank: Making a game of phishing

What are the most effective types of security controls and end user training approaches to dealing with phishing?