Despite warnings, phishing remains highly effective because attackers trick people instead of hacking computers.