Nobody clicks the obvious one.

The message that gets you does not look like a scam. It looks like something you would normally open. That is the point.

Most people feel safer than they are because they are filtering for the obvious red flags. Scams that work do not have obvious red flags. They look like the familiar message you have seen a hundred times.

Check the message that looks the most normal. That is the one worth verifying.