Well on a mass scale you're right, but if you're targeting a particular person X, you may create a throwaway gmail account impersonating X's friend Y, and send

Well on a mass scale you're right, but if you're targeting a particular person X, you may create a throwaway gmail account impersonating X's friend Y, and send an innocuously looking pdf/doc/xls/lolcat gif as an attachment. IMO lots of people may fall prey to this kind of attack if the email looks legit.