Authority bias

People comply more readily with requests that appear to come from authority, and attackers borrow authority precisely because it works.

A message apparently from the chief executive, the regulator, the IT department or the police shortcuts the scrutiny that the same request from a colleague would receive. It is not gullibility; deference to authority is generally useful. The defence is procedural, because asking people to be less deferential does not work.