Social Engineering lessons
What is social engineering?
An inbox checks a suspicious email for six red flags as its phishing risk climbs, then checks a genuine one.
Social engineering means tricking people into handing over information, money or access. It targets people, not computers.
The most common form is phishing: a fake message dressed up as one from someone you trust. Warning signs like the six above are called red flags.
This course shows the tricks attackers use, how to check a message, and how to report one.
Why it works: six pressures
A large 2026 study of data breaches found a person was involved in about six in ten of them. Often that person was simply tricked.
Scams push on six feelings: urgency, authority, scarcity, liking, fear and curiosity. Each one cuts short the moment where you would stop and check.
So when a message makes you feel rushed, scared or excited, treat that feeling as a cue. Slow down before you act.
Six pressures, each shown in a real-looking message with the words that do the pushing.
Practice: Name the pressure
Match each message to the pressure it uses.
Phishing emails
A phishing email copies a bank, a delivery firm or a colleague. Most are sent to thousands of people at once, hoping a few will click.
Check the sender first. The display name can say anything, so read the address after it.
Then read what it asks for. A real organisation never asks for your password, PIN or a one-time code by email.
Practice: Spot the red flags
Tap every red flag in a phishing email.
Where does a link really go?
The words on a link can say anything. To see the real address, hover over it on a computer, or press and hold it on a phone.
Find the first single slash after https://. The name just before it is the domain, and it tells you who owns the site.
Anything in front of the domain is a subdomain, which the owner can name freely. A scammer can put a bank's name there.
Links are taken apart to find the domain that really owns each one.
Practice: Read the link
Type the domain a link really goes to.
Lookalike domains
Scammers register domains that look like real ones at a glance. These are called lookalike domains.
The usual tricks are a digit for a letter, rn for m, an extra word, or a different ending. Read the domain slowly, letter by letter.
Real and lookalike domains lined up letter by letter, with the changes marked.
Practice: Real or lookalike?
Sort sender addresses into real and lookalike.
Scam texts: smishing
Smishing is phishing by text message. We read texts quickly and trust them, which is exactly what scammers want.
Common scam texts claim a missed parcel, a bank alert or a relative with a new number. The sender name at the top can be faked too.
Three scam texts arrive, and each one's red flags are marked.
Scam calls: vishing
Vishing is phishing by phone call. The caller ID on your screen can be faked to show your bank's name or number.
Scam callers create panic, then ask for a code, a password or a transfer to a "safe account". Your bank will never ask for any of these.
A fake bank call plays out, with each warning sign marked as it happens.
Practice: Choose the safe move
Pick the safe response to scam texts and calls.
AI voice clones and deepfakes
AI can copy a voice from a short clip, such as a video or a voicemail. A deepfake goes further and fakes a face on a video call.
In 2024, a finance worker in Hong Kong paid out about 25 million US dollars after a video call. The other people on the call were deepfakes.
So a familiar voice or face is no longer proof. Judge the request, not the voice.
A cloned voice note asks for an urgent payment, and a call back exposes it.
Check through a second channel
When a message asks for money, data or access, check it another way. This is called verifying through a second channel.
Use contact details you already have, like the number on your bank card or in the staff directory. Never use a number or link from the message itself.
Some families and teams agree a code word for urgent requests. A voice clone cannot know it.
The four steps of checking a request through a second channel.
Practice: Verify the request
Put the steps for checking a request in order.
Spear phishing and business email compromise
Spear phishing is a message written for one person. The attacker uses public details, like your job or your manager's name, to make it convincing.
Business email compromise (BEC) uses a fake or hacked work email to ask for money. A classic version tells the finance team that a supplier's bank details have changed.
BEC is one of the costliest kinds of cybercrime, with losses in the billions of dollars each year.
Public facts about one employee are turned into a tailored email.
Pretexting
Pretexting is when an attacker invents a role and a story, called a pretext. They might pose as IT support, a new starter, an auditor or a delivery driver.
The story gives them a reason to ask. A few true details, found online, make it sound real.
A fake IT support call, built stage by stage.
Baiting
Baiting offers you something tempting so that you take the hook. The bait might be a USB stick left in a car park, or a prize that looks too good to be true.
A found USB stick can carry hidden software, or pretend to be a keyboard and type commands. Never plug one in: hand it to IT.
Two baits, each with its hook and the safe move.
Tailgating and physical tricks
Tailgating is following someone through a secure door without using a pass. Attackers carry boxes or coffee so you hold the door to be polite.
Other tricks include a fake uniform, shoulder surfing (watching you type a PIN or password) and searching bins for papers.
It is fine to ask, "Can I see your pass?" Send visitors to reception.
Someone follows a member of staff through a secure door, and gets sent to reception.
Practice: Name the attack
Name the kind of attack in each scenario.
Password managers and MFA
A password manager stores a different strong password for every site. It matches the site's domain before filling one in, so it stays blank on a lookalike.
Multi-factor authentication (MFA) asks for a second proof, such as a code or an app prompt. A stolen password alone is then not enough.
Codes can still be phished, so never share one, and only approve prompts you started. Passkeys are tied to the real site, so a fake site cannot use them.
A password manager fills in a login on the real site and stays blank on lookalikes.
Practice: Will it fill in?
Decide which pages a password manager will fill in.
Report it, fast
One report can protect everyone who got the same message. At work, use the Report button in your email app, or tell IT.
Report it even if you clicked. The sooner IT knows, the sooner they can reset passwords and remove the message from other inboxes.
In the UK, forward scam texts to 7726 and scam emails to report@phishing.gov.uk. If you lost money, call your bank straight away.
One person reports a phishing email, and it is removed from every inbox that got it.
Practice: You slipped up. What now?
Match each slip to the first thing to do about it.