It can be much more subtle than that and I have seen people like you fall for it (or for other social-engineerings attacks) more than once...