It turns out that halfway clever phishing attacks really, really work

[Cunk]

Just being asked to log in would make me immediately suspicious. I mean, I was just logged in reading my email. Why is this here?

Or am I misunderstanding the mechanism?