Which statement about phishing attacks is most correct?

Spear phishing attacks are easy to detect with scanners or filters.

Phishing attacks are rarely succerssful, and so they pose very low risk to organizations. Phishing attacks of all kinds are still in use, because they can be effective social engineering tools when trying to do reconnaissance or gain illicit entry into an organization or its systems.

Attackers learn nothing of value from you if you simply reply to an email you suspect is part of a spear phishing or whaling attack and say "Please remove me from your list."