Phishing also catches the huge number of people who don't analyze whether a URL is exactly the same as the real company's, even assuming they have the background to do so. And those people, whether "stupid" or merely "uninformed", are in the VAST majority.
Show a left-hand-thread bolt to 100 people and ask them to describe it. 99 will only tell you "It's a bolt", and if you're lucky, 1 in 100 will mention "with a left-hand thread".
You (and I) might say "Well you can tell by the angle of the thread that it's left-handed", but the vast majority of people don't even know what to look for.
Same with URLs.
I get lots of phishing emails. You don't need a technology background to look at the URL and figure out it's a scam. Half of them are for products I don't use. For instance WalMart, never been to their stores. Yet they tell me I need to verify my account by clicking a button. You look at the URL behind the sender and the first part looks innocent like "WalMartServices..." but the last part might be "...mike_ubungu.nigeria" or whatever. I delete all phishing emails without response, and only go to official sites for products I use. Those scammers should be hung for wasting our time.