A retail employee receives an email that looks like the payroll vendor and is asked to type a network password into a lookalike site. Which attack is that?
Select an answer to reveal the explanation.
Short Explanation
You can recognize phishing because the email imitates the payroll vendor and asks you to enter your password on a lookalike site. Vishing uses a phone call, pharming poisons DNS, and shoulder surfing watches you type.
Full Explanation
Phishing is a message, usually an email, that impersonates a trusted party and lures you into revealing a secret. Here, the email imitates the payroll vendor and asks you to enter your password on a lookalike site, so the attack is phishing. Vishing uses the same kind of password lure by phone, but this request arrives by email. Pharming poisons DNS so the real payroll name resolves to an attacker’s site; the scenario says you are directed to a lookalike site, not that the real name was poisoned. Shoulder surfing involves watching someone type a secret at the register, whereas this password theft is attempted through the email. Exam caveat: a lookalike site can be paired with malware, and a fraudulent request for credentials is still phishing. As a practical check, preserve the email headers, block the lookalike domain, and confirm the mail filter catches another copy of the lure. Reset the password only if the employee actually submitted it, and keep the original message for the investigation.