learn/phase-1/p1-w3/lesson 03
Week 3 · lesson 3

Social Engineering & Phishing

Interactive: judge real-looking emails in the phishing quiz beside the lesson.

What you'll learn

  • Define social engineering and list its main tactics.
  • Recognise the four psychological triggers attackers pull.
  • Spot common phishing techniques: lookalike domains, homographs, spoofing.

Social Engineering & Phishing

Not every attack targets a machine. The easiest target is often a person.

Social engineering is the psychological manipulation of people into taking actions or giving up confidential information.

Tactics

  • Phishing, fake emails that look legitimate, to steal passwords or deliver malware.
  • Smishing & vishing, the same idea over SMS (smishing) or voice calls (vishing).
  • Baiting, leaving something tempting (a "free" USB drive) for a victim to pick up and plug in.
  • Pretexting, inventing a believable story ("I'm from IT support") to extract information.
  • Tailgating, physically following an authorized person through a secure door.

The four psychological triggers

Attackers push the same emotional buttons again and again:

TriggerExample line
Urgency"Your account will be suspended in 24 hours."
Authority / trust"I am the CEO, click this link and fill the form."
Fear"Your account was logged in from Russia."
Greed"You have won Rs 50,000 in a lucky draw."

If a message makes you feel one of these strongly and suddenly, slow down, that feeling is the attack.

Phishing up close

Phishing uses fake messages that appear to come from a real person or organisation. Variants by target:

  • Spear phishing, aimed at one specific individual.
  • Whaling, aimed at "big fish": CEOs, CFOs, top executives.
  • Pharming, redirecting a victim's web traffic from a legit site to a fraudulent one (often via DNS poisoning).

Techniques to recognise

  • Domain name manipulation: google.com vs g00gle.com (zeros for o's).
  • URL masking: the visible text says saarathiacademy.com.np but the real link goes to phisher.test.
  • Homograph attacks: letters from other alphabets that look identical, gооgle.com may use Cyrillic "о".
  • Typosquatting: registering common misspellings, gooogle.com, facebok.com, amazom.com.
  • Brand impersonation: copying logos and design of banks, Google, Microsoft, or government portals.
  • Attachment-based: malware disguised as documents, invoice.pdf.exe, report.docm.
  • Email spoofing: faking the From address so a message appears to come from a trusted sender.

A note on the physical world

Social engineering is not only digital. RFID cloning, copying the wireless signature of an access card, lets an attacker walk through a door they were never given a key to. Same principle: exploit trust in something that looks legitimate.

Takeaway

Technology can be patched; people cannot. The defense is awareness, verify before you trust, especially when a message is urgent, authoritative, frightening, or too good to be true.

Check your understanding

3 questions

Type an answer and press Check. Grading is keyword-based and forgiving, so short answers are fine.

  1. 1

    An email's link text shows paypal.com but the real destination is paypa1-secure.com. Name the technique.

  2. 2

    Subject line: 'URGENT: your account will be locked in 1 hour unless you verify.' Which psychological trigger is this?

  3. 3

    An attachment arrives named invoice.pdf.exe. What type of file is it actually?