A finance clerk receives an unexpected email urging an immediate change to vendor wire instructions. Which threat vector best describes this attack?
Select an answer to reveal the explanation.
Short Explanation
Urgent email, weird wire-change request, pressure on the clerk—that is phishing riding the inbox, not a USB left under a windshield or a chip-fab conspiracy. The vector is the message.
Full Explanation
An unexpected email urging a finance clerk to change vendor wire instructions immediately is classic message-based phishing delivered by email. The attack manipulates a human workflow—payment change control—through deceptive content, urgency, and apparent legitimacy. The vector is the message channel targeting people who can move money, not a physical implant or offline media attack.
A malicious USB drop in the parking garage with no email involved is a physical/media vector, which this scenario does not describe. Supply-chain compromise of a hardware TPM at the factory is a manufacturing-time integrity attack unrelated to an inbox wire-change lure. An on-path attack against an offline backup tape in the vault targets stored backups in transit or handling paths, not an email to a clerk.
Exam caveat: phishing is social engineering via messaging (often email); identify the delivery channel and the human action requested. Operational check: require out-of-band verification for municipal vendor payment changes, train clerks to resist urgency cues, deploy email authentication and banner warnings, and route finance exceptions through dual approval so a single phished message cannot redirect citizen-funded payments.