An email appeared on the ophthalmology practice manager’s cell phone while she was waiting for an emergency dental appointment. It appeared to be from one of the physician partners, requesting a form to change his payroll direct deposit. The practice manager replied that she’d send it when she returned to the office. She did and then received the completed form, with a signature “presented in the exact same way” that the partner signs his name. And so, despite 27 years of management experience, the practice manager became the victim of a phishing attack.