Phishing and Social Engineering
An email arrives for Sam, apparently from Priya: "I'm in a meeting, need you to pay this new supplier invoice today, bank details attached. Don't call, just do it." No malware, no clever code. Just a message designed to make a helpful person act fast. Most successful attacks on small organisations start like this.
The rule
Urgency plus an unusual request means stop, then verify another way.
Social engineering means manipulating people rather than machines. The main forms:
- Phishing — fake emails that push you to click a link, open an attachment, or enter a password.
- Spear phishing — phishing tailored to one person, using real names and details.
- Whaling — spear phishing aimed at the boss or someone with money authority.
- Smishing — the same trick by text message (SMS).
- Vishing — by voice call, often pretending to be the bank or IT support.
- In person — tailgating (following staff through a locked door), shoulder surfing (watching someone type a PIN), and impersonation (a "repair engineer" who needs to see the router).
They all pull the same levers: urgency, authority, fear or reward, plus a request to skip the normal process.
The defence is not "be clever enough to spot every fake". It is a habit: when a message is urgent and unusual, confirm it through a channel you already trust, like a phone number you already have, never the one in the message.
The shortcut
Scan any message for three flags: Is it urgent? Is it unusual? Does it ask me to skip a check? Two flags or more: stop and verify by another channel.
Urgent?
"Today", "don't call". Yes.
Reporting matters as much as not clicking: one report lets you warn everyone else who received the same message. And if someone does click, reporting fast is what limits the damage. Never punish people for reporting.
Drills
Answer fast — trust the rule.
A text message says the shop's bank account is locked and gives a link to "unlock it now". What is this?
A caller claiming to be the bank asks Priya to read out a code just sent to her phone. What should she do?
Someone in a delivery uniform follows Leo through the staff-only door without swiping. What is this called?
A carefully written email targets Priya, the owner, asking her to approve a large transfer. What best describes it?
Remember
- Urgency plus an unusual request means stop, then verify another way.
- Three flags: urgent, unusual, skipping a check. Verify on a channel you already trust.
- Trap: trusting contact details inside the suspicious message, and staying quiet after a click.