Can Users Be Trusted to Skirt Hackers’ Lures?