We can eliminate prepending as an answer option because preprending attacks add prefixes to existing email addresses and other identifiers and this isn’t mentioned here. Pharming attacks trick users into visiting a malicious website, so that isn’t correct either. This is definitely a phishing attack, because it is soliciting sensitive information from customers over email. That leaves us with two possibilities: whaling and spear phishing. This attack is best described as a spear phishing attack because it was not sent blindly to many recipients but rather targeted at individuals who are actually customers of the company. Whaling attacks work in a similar way but target senior executives.