Overview
Social engineering is the art of manipulating people — rather than machines — into revealing information or taking harmful actions. Its most common form is phishing: fraudulent messages that trick recipients into clicking, downloading, or divulging secrets. This lesson explains phishing and how to spot it. The goal here is purely defensive awareness.
Learning objectives
- Define phishing and its main variants.
- Recognize the psychological levers phishing uses.
- Identify red flags in a suspicious message.
Core concept
Phishing uses deceptive communications, usually email, that appear to come from a trusted source to trick victims. Variants:
- Spear phishing — targeted at a specific person or organization, using researched details to seem credible.
- Whaling — spear phishing aimed at senior executives ("big fish").
- Smishing — phishing via SMS text messages.
- Vishing — phishing via voice calls.
Phishing works by exploiting human psychology — the same levers across all variants: authority (appearing to be the boss or IT), urgency ("act now or lose access"), fear, curiosity, and trust in familiar brands.
How it works
A typical phishing email impersonates a known service, creates urgency ("your account will be suspended"), and directs the victim to a look-alike site that harvests credentials, or to an attachment that installs malware. Attackers often register domains that look almost right (e.g. a subtle misspelling) and copy real branding so the message is visually convincing.
Practical example
An employee receives an email that appears to be from their IT department: "Your mailbox is full. Verify your password within 24 hours or lose access," with a link to a page that looks exactly like the company login. The urgency and apparent authority push a hurried user to enter their password — which goes straight to the attacker. Red flags: the pressure, the unusual request to "verify a password," and a link whose real domain does not match the company.
Cybersecurity relevance
Phishing is the initial vector for a huge share of breaches, from credential theft to ransomware. Because it targets people, technical controls alone cannot stop it — awareness (covered later in this module) is essential.
Common mistakes
- Trusting a message because it looks branded and familiar — branding is trivial to copy.
- Reacting to urgency without pausing to verify through a separate channel.
- Checking only the display name, not the actual sender address and link destination.
Key takeaways
- Phishing uses deceptive messages impersonating trusted sources to steal information or deliver malware.
- Variants include spear phishing, whaling, smishing, and vishing.
- It exploits authority, urgency, fear, and trust; verifying independently is the core defense.
Check your understanding
- List three red flags that suggest an email is phishing.
- Why can't email filtering alone eliminate phishing risk?