This is exactly the weakness that phishing exploits all the time - they only need to succeed a small percentage of the time. If they rely on users being vigila

This is exactly the weakness that phishing exploits all the time - they only need to succeed a small percentage of the time. If they rely on users being vigilant or noticing odd behaviour, they are guaranteed to succeed some percentage of the time. That's a flawed system, not something you should blame on the user.