I have chatted to both users about this, and they both felt that they were lured into entering their details because it looked like it came from someone they knew. More training needed, but with attacks constantly evolving there is always going to be a chance that someone is caught again!