Well the user certainly doesn't know how to determine trust, otherwise scams and social engineering wouldn't work.