When someone sends an email to a user falsely claiming to be a legitimate business/domain etc. with the hopes that the receiver of the email will answer the email, therefore giving valuable information to a potential cyber criminal. Example: someone may find out what bank you use, and send you an email looking to “verify” an account. When in reality you may be giving your account number to a cyber criminal.