The truly sad part is that they wouldn't do it if it didn't work. They don't need a very high response rate to do a lot of damage.

Thousands of folks willingly give away sensative information via such messages.