I guess most people don't understand this?

Assume inbound messages concerning control are scams. Money (financial control), identity (gateway to financial control), etc.

It's extremely cheap to call the supposed originator to confirm he did, in fact, originate it.