Intent matters here. They ultimately fell prey to social engineering, they didn't give out their credentials or do this themselves.