Why do people keep falling for this bait?

Answer 1

The one simple reason is the human factor involved. Even though organizations train their users regularly and raise awareness about the latest phishing techniques, sophisticated threat actors do create such convincing emails and use innovative social engineering tricks to find their next victim, who could be, the one who was trained to be safe. The only trickiest part for the threat actor(s) is to convince their prospective victim(s) to respond immediately to the call to action (CTA). If they do, the bait laid was a success.