A user receives an email formatted to appear as if the bank sent it. The email explains that the user must confirm the name, address, and social security number listed on the bank account. Which of…

Shoulder surfing involves directly observing someone entering sensitive information, typically over their shoulder, not through an email.

Social engineering is a broad category of attacks that manipulate people into performing actions or divulging confidential information, and while phishing is a form of social engineering, 'phishing' is the more specific and best description for this email-based attack.

Spam refers to unsolicited bulk electronic messages, but it does not inherently imply an attempt to trick the user into revealing sensitive information, although phishing emails can be a type of spam.

Phishing is a specific type of social engineering attack that involves sending deceptive emails or messages, often disguised as legitimate entities like banks, to trick recipients into revealing sensitive information such as account details, passwords, or social security numbers. The described email, pretending to be from a bank and requesting personal information, is a classic example of a phishing attempt.