Social engineering
Manipulating people rather than technology to gain access, information, or a fraudulent payment.
It covers phishing, but also phone calls to the help desk requesting a password reset, someone in a high-visibility vest following an employee through a badge door, and a text message that appears to come from the owner asking for gift cards. The common thread is urgency plus plausible authority.
It works because organizations run on helpfulness. The counter is not suspicion of everyone, it is having a defined process for the specific requests attackers exploit, so that following the process is the normal thing to do rather than an act of distrust.
Where this comes up
Social engineering sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.