I work for a mid-sized credit union and we had our first social engineering test which was a combination of vishing / phishing and the CEO fell for it, hook, line and sinker along with 10 other employees. Hopefully they will all learn from it.