Sure, but I guess I'd never reply unless I specifically had just requested a pass reset or something similar. I get that this social engineering trick is like

Sure, but I guess I'd never reply unless I specifically had just requested a pass reset or something similar. I get that this social engineering trick is like most others and preys on people who don't think about what they're typing or replying to, but isn't that the case with a lot of similar tactics? If a malicious actor can trick someone into giving out a PIN or a password by impersonating their email host or bank or whatever, their work is relatively easy.