Why careful people still click phishing links

Sarah opened a file from her accountant's real email address and typed her password to view it. She was not careless, she was doing her job. What our training sessions show about who clicks and why, and the ten-second habit that catches it.