If the user had been warned NOT to trust ANY such popups, and to not click any areas of the popup (because buttons may be deliberately mislabelled) but to close the browser instead, the attack would not have succeeded.
If the user had been warned NOT to trust ANY such popups, and to not click any areas of the popup (because buttons may be deliberately mislabelled) but to close the browser instead, the attack would not have succeeded.