These scams always hit hardest by timing. For example if you just used your credit card in a different city and then by coincidence right after you get a phishing email that looks like it came from your bank, the seeming urgency disengages prudence.