A finance employee receives a phone call from someone claiming to be from the company's IT help desk. The caller states there is an urgent security incident and asks the employee to read back the one-time passcode that was just texted to their phone so IT can 'verify the account.' The employee complies, and minutes later notices unauthorized logins to their account. Which type of attack does this scenario BEST describe?