Phishing attacks are successful when
The web server is not patched
The attack entices a user to perform a certain action
Users do not patch their machines
Users share email accounts