The CFO receives an urgent phone call from someone who sounds like the CEO, insisting that a wire transfer to a new supplier be approved before the end of the day and kept confidential. The awareness team categorizes every reported social engineering incident by its delivery channel. How should this incident be categorized?
Select an answer to reveal the explanation.
Short Explanation
Ask yourself one question: how did the lie arrive? It came over the phone, so you label the channel vishing, voice phishing. Whaling's a tempting trap because the CFO is a big fish, but that term describes who's targeted, not the channel the team is sorting by.
Full Explanation
Vishing is social engineering delivered through voice communication, such as a phone call or voicemail, in which the attacker impersonates a trusted party and applies pressure through urgency and secrecy. Because the awareness team's taxonomy is based on delivery channel, a fraudulent call impersonating the CEO is classified as vishing regardless of who received it. Whaling describes the target rather than the channel: it is phishing aimed at senior executives, so although the CFO is an executive, that label answers a different question from the one the team's taxonomy asks. Smishing is phishing delivered by SMS or other text messaging; urgency is a common feature of every social engineering channel and does not make a phone call a text message. Spear phishing refers to targeted, personalized phishing usually delivered by email; personalization is a characteristic of the pretext, not a channel, and no email was involved here. Exam caveat: a single incident can fit several labels at once, so read the stem for the classification criterion being applied before choosing. Operational check: confirm the call's origin, require out-of-band callback verification to a known number and dual approval for any new-payee wire transfer, and log the report under voice-based social engineering with the executive-targeting detail noted.