Except people want to view the content. If they think my friend has sent a picture, or a business has sent an invoice, they're likely to click it. Especially

Except people want to view the content. If they think my friend has sent a picture, or a business has sent an invoice, they're likely to click it. Especially in the 3 receiving situations that bb123 outlined (1, 3 and 4) you're not likely to have the contact info, or it's plausible that the person could be using another phone to send that message. Now - I know to check the sender, don't click strange links, all of that. I run trainings on how to avoid phishing and improve personal & organizational digital security. But it comes down to the fact that people are using technology as a tool. Apple made headway with BlastDoor but it's clearly not good enough.