a user receives a phone call from a person who claims to represent it services and then asks that user for confirmation of username and password for auditing purposes. which security threat does this phone call represent?