Yup! I had a great reminder of this recently:

I always ignore spam text messages, but got a phishing attack message made to look like a USPS update about 2 months ago they almost fooled me because I had a legitimate package that was missing. I clicked the link, and even entered my email address in the landing page form and was about to enter credit card details for a $2 ‘redelivery’ charge - which I was also primed for because I’d recently paid USPS a similar amount to redirect my mail after moving.

I was creating a one-time use virtual card to make the payment when my thoughts caught up with me and I realized it wasn’t a legitimate page.