🎭 Social Engineering
How attackers hack people, not computers⏱ ~2 min
A hacker breaking through a firewall is like trying to pick a bank vault lock — it's hard and takes skill. Social engineering is like walking up to the vault manager, showing a fake badge, and asking them to open it for you. It's almost always easier to trick a person than to break a technical system. This is why social engineering is the #1 attack vector — it bypasses all your security software instantly.
Why It Works — The Six Triggers
- •Authority — 'I'm from IT, I need your password to fix your account.' We're trained to comply with authority figures.
- •Urgency — 'Your account will be deleted in 10 minutes!' Panic kills critical thinking.
- •Fear — 'You've been hacked — act now or lose everything.' Fear stops rational evaluation.
- •Trust — 'Your friend Sarah sent this link.' We lower our guard with familiar names.
- •Greed — 'You've won a $500 gift card — click to claim!' The reward seems worth the risk.
- •Helpfulness — 'Can you hold the door? My hands are full.' We're socially conditioned to help.
Common Social Engineering Attack Types
| Attack | What It Is | Example Red Flag |
|---|---|---|
| Phishing | Fraudulent email pretending to be a trusted source | Sender is support@paypa1.com (note the '1') |
| Vishing | Phone call scam — voice phishing | 'This is the IRS — you owe $2,400, pay now or be arrested' |
| Smishing | SMS text message phishing | Text: 'Your package is delayed — verify here: bit.ly/abc' |
| Pretexting | Fabricated story/scenario to extract information | Caller claims to be an auditor needing your employee ID |
| Tailgating | Following an authorized person through a secured door | Person behind you says 'forgot my badge, can you hold it?' |
| Shoulder Surfing | Watching someone type a PIN or password | Person standing too close at an ATM or coffee shop |
| Hoax | False alarming message spread to cause panic or bad decisions | 'Forward this warning to everyone — new virus destroying phones!' |
| Typosquatting | Fake website with a URL similar to a real one | arnazon.com instead of amazon.com |
Practice: Spot the Red Flags
FROM: helpdesk@school-it-support.net SUBJECT: URGENT: Your school account will be suspended in 2 hours! Dear Student, Our security system detected unusual activity on your account. You MUST verify your identity immediately or your account will be permanently suspended. Click here to verify: school-verify-now.com. This is your FINAL WARNING.
- ⚑Sender domain is 'school-it-support.net' — not your school's real domain
- ⚑Extreme urgency: '2 hours' and 'FINAL WARNING' — designed to prevent you from thinking carefully
- ⚑The link goes to 'school-verify-now.com' — not your school's actual website
- ⚑Threatening language: 'permanently suspended' creates fear
- ⚑Legitimate IT departments never ask for password verification this way
An employee receives a call: 'Hi, this is David from corporate IT. We've detected ransomware spreading on your network right now. I need your login credentials immediately to lock down your account before it's compromised. Every second counts.' Which social engineering triggers is the attacker using?