💡 A. Shoulder Surfing: This involves an attacker physically observing someone’s screen or keyboard to steal sensitive information, such as passwords or PINs. Since the attacker in the scenario used deception rather than direct observation, this is not the correct answer. B. Pharming: This attack redirects users from legitimate websites to fraudulent ones without their knowledge, typically by exploiting DNS vulnerabilities. The scenario does not involve website redirection, so this option is incorrect. C. Phishing: Phishing attacks involve fraudulent emails, messages, or websites designed to trick victims into revealing sensitive information. While phishing is a form of social engineering, the given scenario describes an attacker directly deceiving the employee through impersonation rather than using digital communication methods. D. Social Engineering: This is the correct answer because social engineering relies on psychological manipulation to trick individuals into revealing confidential information. The attacker in this case posed as a bank representative, which is a classic social engineering technique.