Phishing is an extremely effective attack vector. My company's security group regularly and randomly sends out phishing emails. Those falling for it are sent to training for how to identify a phishing attack. I've heard anecdotally that some people have had to go to the training three times! Which I don't say to gloat - but merely to point out how well that attack vector works.