Look at all the your-account-has-been-suspended phishing spam that's out there. They wouldn't be sending it if it didn't sometimes work. That's a social engineering attack.
And since I wrote my original reply I've come across another case: A forged e-mail from the boss to an underling directing them to pay a 6-figure sum to a certain bank account in payment for a painting they purchased. Whoever tried this spearphish didn't know his target well enough, such a purchase would have been way out of character for him.