How often do they assume that non-scams are scams? That part has always made me curious when talking about these tests, I mean I have a mostly fool proof way (

How often do they assume that non-scams are scams? That part has always made me curious when talking about these tests, I mean I have a mostly fool proof way (type the url or navigate to it from the main page), but even including "this page is not linked from anywhere else for security, you must click the link) would probably fool people. Especially because I can imagine many orgs would actually include that.