Most people picture a cyber attack as something dramatic. Code scrolling down a screen, firewalls falling over, an alarm somewhere. The reality is far more ordinary. A delivery notification arrives by text. A supplier emails an updated invoice. A login prompt appears at the exact moment someone expected one. Nothing is broken into. Nobody writes malware. A person simply does what the message asked,