A more trivial gambit is logging into an attacker controlled site leaking credentials or installing malware.

Also office drones are probable targets. They won't want to waste important peoples time asking for confirmation.