Phishing and Social Engineering

You can lock a house with the strongest deadbolt money can buy — but if a stranger knocks, says "I'm here to read the meter," and you simply open the door, the lock never mattered. Attackers know this. Instead of fighting a computer's defences, they often go after the easiest way in: the person using it.

Social engineering is the art of tricking people — not machines — into giving away information or access they shouldn't. There's no clever hacking of code; the attacker manipulates human feelings like trust, fear, curiosity or the wish to be helpful. Security experts call the alert, sceptical human being the "human firewall", because in the end a person is the last line of defence — and often the first thing an attacker tries to get past.

Phishing: the everyday attack

By far the most common form of social engineering is phishing: sending fake emails, texts or setting up fake websites that pretend to be a trusted organisation — your bank, a delivery company, a games platform, your school — to fool you into handing over passwords, card details or other secrets. The word is a play on "fishing": the attacker dangles convincing bait and waits for someone to bite.

A phishing email usually pushes you to click a link that leads to a counterfeit login page. It looks just like the real site, but anything you type goes straight to the attacker. You think you've logged in; in reality you've just handed over your username and password.

Sometimes attackers do. Ordinary phishing is like casting a huge net — the same message blasted to millions, hoping a few bite. Spear phishing is aimed at one person, using real details (your name, your manager, a project you're working on) to seem far more believable. When the target is a rich or powerful individual — a chief executive, say — it even has a name: whaling. The more personal the bait, the harder it is to spot.

Spot the fake: tell-tale signs

Real phishing messages leak clues. Below is a fake email pretending to be from a bank. Step through the figure to reveal the warning signs — then you'll be able to spot them in the wild.

The classic warning signs, in one list:

Urgency or threats — "Act within 24 hours or your account will be closed!" Panic makes people click before they think.
Generic greeting — "Dear Customer" or "Dear User" instead of your real name. Your actual bank knows who you are.
Dodgy sender address — the display name says "Bank" but the real address is something like security@bank-alert-verify.net.
Misspelt or disguised links — www.b4nk-secure.com, or a link whose visible text and real destination don't match (hover to check).
Requests for secrets — no genuine organisation ever emails asking you to "confirm" your password or full PIN.
Too-good-to-be-true offers — "You've won a free phone! Just pay postage." If it seems too good to be true, it is.
Spelling and grammar mistakes — real companies proofread; many scam messages don't.

What to do about it

Spotting a phish is only half the job — knowing how to respond is the other half:

Don't click. Never tap a link or open an attachment in a message you weren't expecting.
Check the real address yourself. If "your bank" emails you, don't use their link — type the bank's known web address into your browser, or use its official app, and log in the normal way.
Verify through another channel. Phone the organisation using a number from its official website or the back of your card — not a number given in the suspicious message.
Report it, then delete it. In the UK you can forward scam emails to report@phishing.gov.uk and forward scam texts to 7726. Tell an adult or your IT team at school or work.
If you did click and enter details, change that password immediately — and any other account that shares it.

Social engineering attacks people, not software. The very best antivirus, firewall and encryption in the world will not save you if a human is simply persuaded to hand over a password or click a malicious link — the attacker walks straight through the front door you opened for them. That's why technology alone is never enough. When a message pressures you to act right now, that urgency is itself the red flag: slow down, stop, and verify through a channel you trust before you do anything.

Beyond the inbox: other tricks

Phishing lives on screens, but social engineers use plenty of low-tech tactics too. They all rely on exploiting human nature rather than breaking software:

Pretexting — inventing a convincing fake story ("pretext") and role. Someone phones claiming to be "IT support" and asks for your login "to fix a problem." The confident story is the whole attack.
Baiting — leaving a temptation lying around. A USB stick labelled "Exam Answers" or "Salaries" is dropped in a car park; whoever plugs it into a computer out of curiosity installs the attacker's malware for them.
Shoulder-surfing — simply watching over your shoulder as you type a PIN or password, at a cash machine or on the bus.
Tailgating — following an authorised person through a locked door before it shuts, often while carrying boxes so someone politely holds it open.

Constantly. Many of the biggest data breaches in history didn't start with genius code-breaking — they started with one convincing email or phone call to one employee. Attackers have posed as bosses to trick finance staff into wiring huge sums, and as help-desk workers to reset the passwords of people who never questioned the friendly voice. It's a sobering reminder that the cheapest, most reliable "hacking tool" is a good story told to a trusting human.