No government agency wants its employees to fall for a phishing scam, but the Virginia State Corporation Commission, which holds Social Security numbers, credit card numbers and…