While performing online banking using a Web browser, a user receives an email that contains a link to an interesting Web site. When the user clicks on the link, another Web browser session starts…

Clickjacking tricks a user into clicking on a hidden or transparent UI element overlaid on a legitimate page, which does not match this scenario where a link opened a separate browser session displaying unrelated content.

Cross-Site Scripting (XSS) involves injecting malicious scripts into the output of a trusted website that then execute in other users' browsers - it is an injection attack on the target site itself, not a forged request originating from an external malicious site.

CSRF exploits the trust a web application places in an authenticated user's browser by causing the browser to send a forged HTTP request to the banking site while a valid session cookie is present. When the user clicked the malicious link, the attacker's site triggered a background request to the bank using the user's live session credentials, authorizing a funds transfer without the user's knowledge. The bank's server had no way to distinguish this forged request from a legitimate one because it carried the user's valid session token.

Web form input validation is a defensive control used to sanitize user-supplied data and prevent injection attacks; it is not an attack vector and does not describe the compromise that occurred in this scenario.