Your guess is wrong. It was a two-step attack that relied on social engineering and misleading. They had scammed about fifty people in Munich by the time it was

Your guess is wrong. It was a two-step attack that relied on social engineering and misleading. They had scammed about fifty people in Munich by the time it was in the papers, and my guess is that a substantial number of ordinary adults here would fall for it. Personally, I consider it quite reasonable if our OSes are set up to make it difficult to scam regular people, even at the cost of making my tinkering difficult. It's the sensible default, IMO. Feel free to disagree, or even to downvote me. (I'm sure some of the fifty-odd people used apps to pay the criminals, but that wasn't relevant to the way the scam worked.)