Picture this: your receptionist gets a call from someone claiming to be from your IT support company. They sound professional, know some details about your business, and urgently need your login credentials to "fix a critical security issue." It seems legitimate, so your employee hands over the information.