Understanding the human factors that make people vulnerable to online criminals can improve both security training and technology