Social Engineering - The oldest and best trick in the book.

The Washington Post has a good article on social engineering attacks. It is a good treatment of the topic.

Short answer, humans are the weak link, and can be defeated with extremely high probability.

The take away from this whole thing is that we need to be building security systems that don't rely on humans not being tricked into compromising their own security. A lot of security architects take a "blame the victim" stance. User's have other things to worry about than security. We need to make sure security happens even if they are not paying attention to it.