An organization recently experienced the following social engineering attacks that introduced malware into the network:

• In the first attack, the sender impersonated a staff member in the legal department and sent an email stating that the employee needed to click a link to sign an NDA in order to remain employed. The link provided was to a malicious website.
• In the second attack, the sender impersonated the director of finance and instructed the accounts payable department to pay an outstanding invoice. The attached invoice contained malware.

Which of the following is the most likely reason these attacks were successful?