attack is one where the attackers may try to call or message you, pretending to be from the site or service, and try to trick you into $$confirming your password".