Social Engineering: recognise manipulation and protect yourself

Social Engineering is an interactive social engineering course about how criminals manipulate people rather than computers, and how to recognise and stop it. Its 24 short sections cover the psychological pressures scammers use, phishing emails, where links really go, lookalike domains, scam texts and calls, AI voice clones and deepfakes, checking through a second channel, targeted email fraud, pretexting, baiting, tailgating, password managers and MFA, and what to do if you slip up.

It is a defensive course: every section is about spotting a technique and knowing the safe response, for yourself, your family or your workplace.

What the course covers

Why it works

Social engineering exploits normal human instincts: trusting authority, wanting to help, fear of missing out, and acting fast under pressure. Most scams create urgency or fear so that you act before you think, which is why the course starts with the pressures before any specific scam.

Recognising the common forms

Phishing uses emails that pretend to come from someone you trust; smishing does the same by text and vishing by phone, now sometimes with AI-cloned voices. Spear phishing and business email compromise target one person or organisation with researched details. Pretexting invents a believable story, baiting offers something tempting, and tailgating means following someone through a secure door.

Defending against it

The most reliable defence is to check any unexpected request through a second channel you already trust, such as calling a known number rather than one in the message. A password manager will not fill in your password on a lookalike site, and multi-factor authentication stops a stolen password being enough on its own. In the UK, the NCSC asks people to forward suspicious emails to report@phishing.gov.uk and scam texts to 7726.

Try a question from the course

Say you get a text, apparently from your bank, saying your account is locked and you must tap a link now. The safe move is not to tap the link or reply, but to contact the bank yourself using the number on your card or its official app, and to forward the text to 7726.

Now choose the safe move in a new situation, then press Mark to check your answer in the course.

Who this course is for

• Everyone with email and a phone, since these scams target ordinary people every day.
• Office workers and small businesses, who face targeted email fraud and fake payment requests.
• Computing students studying social engineering as a threat and the ways organisations defend against it.

What you need to know first

Nothing. The course uses everyday examples of emails, texts and calls. Our TLS and SSL guide explains why a padlock in the address bar does not prove a site is genuine.

How long it takes

There are 24 sections and most take a few minutes. Learners without a plan can open two sections of a course a day, in order, so the whole course takes 12 days. A plan removes the daily limit and lets you go straight to any topic, such as deepfakes.

Read next

Computer Science · Cyber securityWhat is a social engineering attack? Types and examplesA social engineering attack tricks people instead of computers. The main types with examples, the pressures they rely on, and how to defend yourself.