Phishing and social engineering
Lesson 4 of 6
4Phishing and social engineering
The big pictureAccording to IBM, phishing is the most common starting point of a breach for the fourth year running. The reason is simple: fooling a person in a hurry is easier than breaking encryption. And AI now writes phishing in clean language without spelling mistakes, so typos are no longer a sign you can rely on.
What the picture shows: Five steps the scammer needs, and you can stop them at any one: ignore the message, calm down before acting, do not click, notice the domain, or withhold the code.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
The scammer does not break the door; they knock and pretend to be the postman or the bank. They use four psychological keys: urgency ("within 24 hours"), fear ("your account is suspended"), trust (the bank's logo, your manager's name) and curiosity or greed ("you won a prize"). When you feel one of them in a message, that is your cue to stop.
The kinds: generic phishing, spear phishing, whaling for executives, business email compromise (BEC) to divert payments, SMS (smishing), voice (vishing) and QR codes (quishing). The controls: SPF lists the servers allowed to send, DKIM signs the message, and DMARC enforces alignment with the From domain and sets a failure policy. Adversary-in-the-middle (AiTM) proxy pages steal the session even with SMS and TOTP codes; the fix is phishing-resistant sign-in such as FIDO2. Mobile phishing simulations drew 40% more engagement than email ones, per DBIR 2026.
Before You Start
🎯How attackers think
Phishing is the "delivery" stage of the kill chain.
The Core Idea
1Why we fall for it: four psychological keys
Phishing works because it skips thinking and speaks to feelings. When you fear for your account or rush to get a parcel, you notice less. So the golden rule is not only "learn the signs", but: if you feel pressured, stop for a minute.
Drill: spot the six signs of phishing
A training message from a made-up company. Press every part that looks suspicious. There is no real link in it.
From: Ofoq Express Post <>
Subject: Final notice: your parcel is on hold
We could not deliver parcel 88231 because the address is incomplete.
To reschedule, at the link:
Found 0 of 6
- The sender's address: the domain is not the company's official one and carries words like
verify. Scammers register look-alike domains, so read the domain letter by letter. - A generic greeting: services that know you usually use your name. "Dear customer" means the message went to thousands of people.
- Urgency and threats: "within 24 hours" and "cancelled for good" are built to make you act before you think.
- Card details and the one-time code for a small fee: the small amount lowers your guard, and no legitimate party ever asks for your one-time code (OTP).
- A button hiding where it goes: the visible text says nothing about the real address. On a computer hover to see the link; better still, open the official app yourself.
- A double extension: the file ends in
.exe, so it is a program dressed up as a PDF, and opening it may install malware.
2The kinds of phishing
| Kind | How it works | Example |
|---|---|---|
| Generic phishing | One message to thousands | "Your parcel is on hold" |
| Spear phishing | Tailored to one person from gathered details | An email in your manager's name about your current project |
| Business email compromise | Posing as a supplier or boss to divert money | "We changed our bank account" |
| SMS and calls | Smishing and vishing, the costliest per IBM | A "bank employee" asks for the code by phone |
| QR codes | Quishing: a sticker over the real code | A fake payment code on a parking meter |
AI added voice cloning: your relative's or boss's voice urgently asking for money. The fix is simple and old: hang up and call back on the number you know, and agree on a "family password" for emergencies.
3How a mail server checks the sender
The sender address in email is as easy to fake as the return address on a paper envelope. So three mechanisms were added: SPF, a DNS list of servers allowed to send for the domain; DKIM, a digital signature proving the message did not change; and DMARC, which ties them to the domain the user sees and tells the receiver what to do with a failing message.
The real domain is what comes just before the first /, read from the right. Try adding a tricky link of your own.
from urllib.parse import urlparse
official = "ofoq-post.example"
links = [
"https://ofoq-post.example/track/88231",
"https://ofoq-post-verify.example/pay",
"https://ofoq-post.example.track-parcel.example/login",
"https://0foq-post.example/track",
]
for link in links:
host = urlparse(link).hostname
ok = host == official or host.endswith("." + official)
print(("OK " if ok else "FAKE ") + host)4When a one-time code is not enough
Adversary-in-the-middle (AiTM) attacks put a fake page between the victim and the real site, pass the password and code on to the real site instantly, then steal the sign-in session itself. That is why even SMS codes and authenticator apps can be phished. FIDO2 passkeys, though, are bound to the real site's domain, so they never work on a fake page.
Worked example
The task: an employee calls to say they entered their password on a page from an email, then realised it was fake. What do you do, in order?
The answer: (1) reset the password now and end all active sessions, because the attacker may have stolen the session, not just the password. (2) Check the sign-in logs: unusual places or devices, and new mail-forwarding rules. (3) Block the domain and sender, find the same message in other staff mailboxes and delete it. (4) Make sure phishing-resistant MFA is on, and document the incident. (5) Thank the employee for reporting quickly; punishing reporters makes others hide their mistakes.
Myth vs Reality
| Myth | Reality |
|---|---|
| The padlock means the site is safe. | It only means the connection is encrypted. Phishing sites have the padlock too. |
| Phishing is full of spelling mistakes. | AI now writes it cleanly; rely on context and the domain, not spelling. |
| I am too smart to fall for it. | Spear phishing is built for you, at a busy moment. Everyone is at risk; the difference is the habit of pausing and checking. |
Where you meet it at work
🏠At home
You spot fake parcel and bank messages and teach your family.
📧Sysadmin
Sets up SPF, DKIM and DMARC for the company domain so it cannot be spoofed.
🎓Awareness team
Runs phishing simulations and measures the report rate, not just the click rate.
Test your understanding
A file named invoice.pdf.exe is most likely:
The real extension is the last one, .exe; the .pdf part is the trick.
Which mechanism checks a message was not changed and is signed by the sender's domain?
DKIM is a digital signature on the message. SPF only checks the sending server.
Your "manager" emails from a personal address asking for an urgent transfer to a new supplier. The right move?
This is the BEC pattern. Replying reaches the scammer. Call the manager on their known number and tell the security team.
A text message on your phone with a "track your parcel" link is called:
SMS + phishing. Voice is vishing, a QR code is quishing.
Which record tells mail servers what to do with a message failing SPF and DKIM?
DMARC sets the policy: none, quarantine or reject.
Quick review cards
Check Your Understanding
Why does no legitimate party ask for your one-time code?
Because the code proves it is you signing in right now; whoever asks for it wants to sign in as you.
Why are passkeys phishing-resistant?
Because the key is bound to the real site's domain, so it does not work on a fake page, and there is no secret to type and steal.
A message from "your boss" urgently asks for gift cards. What do you do?
Do not reply to that message; call them on their known number, and report the attempt to security.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.