<p>Moreover, the two also are separate if you look at possible consequences. </p><p>The average scam loses people an amount of money they are willing to put up - that&#39;s usually not too much, at least not enough to lose your org or livelihood. Of course, there are exceptions here, especially romance scams can cost people their savings and more; but my focus is organisations here. </p><p>Usually an org scammer asks for gift card codes or something similar. While larger scams have been done, they are almost always preceded by a successful phishing attack somewhere (think business email compromise, CEO fraud etc.). And many orgs have good controls against large-scale monetary scams, like dual controls. </p><p>Phishing, however, can cost you your org. If you lose your IT, or your production is compromised, or both, it can spell doom. We know many, if not most orgs are inadequately set up in terms of security (basic shit like access management, firewalls, backups, authentication).<br />This is what makes account compromise so dangerous, and, by extension, phishing. </p><p>2/3</p>