Never think all social engineering attacks need to be elaborate ruses so complex that they're likely to be recognized before they can be completed. Some are in-and-out, strike-and-disappear, very simple attacks that are no more than ... well, just asking for it.