Study Guide
Social Engineering and Phishing
How attackers exploit trust and human psychology: the triggers they pull, impersonation and pretexting, phishing and its variants, pharming, typosquatting, watering-hole attacks, email spoofing with SPF, DKIM and DMARC, and business email compromise.
Lesson 2.9 Threats, Vulnerabilities & Defence
A locked door can be forced, or the person holding the key can be persuaded to open it. This lesson is about the second way: why it so often works, the forms it takes, and how organisations defend against it.
Stage: Think
The person with the key
Think it through
Show the answer
Answer: B. Persuading them: no tools, no noise.
Persuading the key holder is often easier, cheaper and quieter. Getting what you want by working on people, rather than on the technology, has a name.
Think it through
Think of a time a text, call or email tried to get you to do something quickly. What did it do to make you want to act?
- Hint 1: Was there a deadline, or a threat of something bad happening?
- Hint 2: Who did the message claim to be from?
Show what happens
Most examples use urgency, fear, a figure of authority or a familiar name. Those are the levers an attacker pulls, and the lesson names each one.
Stage: Explain
The idea
Social engineering exploits trust and human psychology. Put another way, it targets the human, not just the technology.
People are helpful, busy, trusting and respectful of authority. Those are good qualities, and organisations depend on them. A social engineer turns them into a route in. In the language of Attack Surfaces and Attack Vectors, people are part of the attack surface, and the deception that reaches them is a vector. The channel that carries it, such as email or a phone call, is a vector too, at a different level of detail: that lesson sets the levels side by side.
Attackers manipulate people into:
- revealing passwords;
- disclosing multi-factor authentication (MFA) codes;
- clicking links;
- opening attachments;
- transferring money;
- disclosing sensitive information;
- granting access;
- bypassing procedure.
Technical controls assume that the person using an account is who they appear to be and means what they do. If an attacker can persuade a real, authorised person to act, many controls are satisfied: the right password was entered, by the right person, from the right computer. That is why social engineering appears at the start of so many incidents, and why defending against it involves people and process as well as technology.
Stage: Check
Why it works: psychological triggers
Social engineering does not depend on people being foolish. It depends on ordinary, predictable reactions.
Common triggers
| Trigger | What the attacker relies on | How it might sound |
|---|---|---|
| Authority | People comply with those in charge. | “This is the finance director.” |
| Urgency | Hurry leaves no time to check. | “It has to be done in the next ten minutes.” |
| Fear | People act quickly to avoid a bad outcome. | “Your account will be suspended.” |
| Curiosity | People want to know. | “See who has viewed your profile.” |
| Trust | People believe a familiar name or brand. | A message that looks as if it is from the bank. |
| Helpfulness | People like to help. | “I’m locked out. Could you let me in?” |
| Familiarity | People relax with someone who seems known. | “We spoke last week about your order.” |
| Reciprocity | People return favours. | “I sorted that problem for you. Could you just…” |
| Social pressure | People follow what others appear to do. | “Everyone else in your team has already done it.” |
A convincing attack usually pulls several at once. A useful personal rule follows from the table: a message that makes you feel rushed, frightened or flattered is a reason to slow down.
Check your understanding
Show the answer
Answer: C. Fear and urgency.
Fear (losing access) and urgency (15 minutes). Together they push you to act before you think of checking.
Stage: Predict
Impersonation and pretexting
Think it through
A caller says: “Hi, it’s Sam from the IT helpdesk. We’ve found a virus on your laptop and need your password to clean it.” Which part is who the caller claims to be, and which part is the story?
- Hint 1: Who does the caller say they are?
- Hint 2: What reason do they give for the request?
Show what happens
Who: Sam from the IT helpdesk. The story: a virus that needs your password to clean. Each has a name.
These two usually appear together, which is why they are confused.
- Impersonation is who the attacker pretends to be: a colleague, a manager, IT support, a supplier, a bank.
- Pretexting is the believable story or scenario used to justify the request.
Someone phones a member of staff, says they are from IT support, and explains that there is an urgent problem with the person’s account. To fix it, they say, they need the six-digit code that has just been sent to the person’s phone.
Taking it apart:
- Impersonation: the caller claims to be IT support.
- Pretexting: the invented story of an urgent account problem that needs a code.
- Authority: IT support is trusted to deal with accounts.
- Urgency: it must be done now.
The code is an MFA code. The caller already has the password and is signing in at that moment; the code is the last thing they need. The right response is to refuse, end the call, and contact IT support through a number already known to be genuine.
Do not confuse: Impersonation and pretexting
- Who?Impersonation
- Who the attacker pretends to be.“I’m from IT support.”
- What story?Pretexting
- The believable scenario that justifies the request.“There’s an urgent problem with your account.”
Stage: Predict
The phishing family
Several techniques share the “-ishing” ending. They differ in who is targeted and which channel is used.
Think it through
Show the answer
Answer: B. The second: it was written for them.
The personalised one: the attacker researched the target, so the details ring true. The broad one relies on numbers instead.
Phishing and spear phishing
Phishing is broad deceptive messaging aimed at stealing information or causing an unsafe action. The same message goes to thousands of people in the hope that some will respond.
Spear phishing is targeted and personalised phishing aimed at a specific person or group. The attacker researches the target first, so the message mentions real names, projects or suppliers and is far more convincing.
Do not confuse: Phishing and spear phishing
- Phishing
- Broad. One generic message to many people.“Your parcel could not be delivered. Click here.”
- Spear phishing
- Targeted. Written for a particular person or group.A message to one finance officer about a real supplier’s invoice.
Whaling is spear phishing aimed at senior or high-value individuals, such as executives or board members: the “big fish”.
Smishing and vishing
The channel changes; the deception does not.
The names are built from the channel: SMS + phishing, and voice + phishing.
Angler phishing
Angler phishing is social-media phishing in which attackers often impersonate a company’s customer-support account and target people who are already asking that company for help.
Someone posts publicly that their bank’s app is not working. A fake “support” account replies within minutes and offers to help by direct message, where it asks for sign-in details. The name comes from fishing with a line: the attacker waits for a likely target and tries to hook them with a fake support conversation.
Stage: Predict
Pharming, typosquatting and watering holes
These three are different in kind. The first redirects people, the second relies on a lookalike address, and the third waits for people to arrive.
Think it through
You type your bank’s correct web address and still arrive at a fake copy of the site. How could that happen, without any message tricking you?
- Hint 1: How does your computer find the server for a name you type?
Show what happens
Something between you and the bank sent you to the wrong place: for example, the system that turns the bank’s name into a server address was tampered with. That is one technique in this group.
Pharming
Pharming redirects users to a fraudulent destination, commonly by manipulating DNS or other name resolution.
DNS is the system that turns a name such as a bank’s web address into the numeric address of a server. If an attacker can tamper with that lookup, a user who types the correct address is sent to the attacker’s copy of the site instead. The user did nothing wrong and clicked nothing.
Do not confuse: Phishing and pharming
- Phishing
- Trick the person. A deceptive message persuades them to act.
- Pharming
- Redirect the traffic. The user asks for the right site and is sent to the wrong one.
DNS manipulation is the classic example of pharming, not the only one. Tampering with the name-resolution settings on a single computer or a home router has the same effect.
Typosquatting
Typosquatting is registering a domain deliberately similar to a legitimate domain, so that users mistype it or fail to notice the difference.
A fictional illustration: a bank’s real site is harbourbank.example. An attacker registers harbourbnak.example, with two letters swapped, and harbourbank-secure.example. Both names are invented for this lesson. People who mistype the address, or who glance at a link without reading it closely, arrive at the attacker’s site.
Typosquatted domains are used for:
- credential theft, through a copy of the real sign-in page;
- phishing, as the destination of a link in a message;
- malware delivery.
Phishing and typosquatting are different things that work well together: phishing is the deceptive message; typosquatting is the deceptive, lookalike domain the message may point to.
Check your understanding
Show the answer
Answer: A. Both: smishing and typosquatting.
Both: smishing delivers the message by text, and typosquatting provides the lookalike domain it points to.
Watering-hole attacks
Think it through
An attacker wants to reach engineers who never open emails from strangers. Where else could the attacker wait for them?
- Hint 1: What websites do professionals read for their work?
Show what happens
Somewhere they already go: a website they trust and visit often. That approach has a name.
In a watering-hole attack, an attacker compromises a website frequently visited by the intended target group and waits for the targets to visit it.
Suppose an attacker wants access to engineers at energy companies. Instead of writing to them, the attacker compromises the website of a trade association that those engineers read. When they visit, the compromised site attacks their browsers. The name comes from predators waiting at a water source that their prey must visit.
A memory aid:
- Spear phishing: go to the target.
- Watering hole: compromise somewhere the target already goes.
The techniques at a glance
| Technique | What defines it |
|---|---|
| Phishing | Broad deceptive messaging. |
| Spear phishing | Targeted and personalised at a person or group. |
| Whaling | Spear phishing aimed at senior or high-value people. |
| Smishing | Phishing by SMS text message. |
| Vishing | Phishing by voice call. |
| Angler phishing | Fake customer-support accounts on social media. |
| Pharming | Users are redirected to a fraudulent destination. |
| Typosquatting | A lookalike domain catches mistyped or misread addresses. |
| Watering-hole attack | A site the targets already visit is compromised. |
Stage: Predict
Email spoofing
Email spoofing means forging part of a message so that it appears to come from someone else. Email was designed at a time when senders were trusted, and by default much of what a recipient sees can be set by the sender.
Common forms:
- Display-name spoofing: the name shown is a trusted one, such as the chief executive’s, while the address behind it is unrelated.
- Sender or domain spoofing: the sender’s address itself is forged to show the real organisation’s domain.
- Lookalike domains: the message comes from a domain that resembles the real one, as with typosquatting.
- Reply-To manipulation: the message appears to come from a genuine address, but replies are quietly directed to the attacker.
- Compromised legitimate accounts: the attacker has taken over a real mailbox. Nothing is forged at all, which makes this the hardest form to spot.
SPF, DKIM and DMARC
Think it through
Email lets the sender set much of what the recipient sees. How could a receiving mail server tell whether a message really came from the bank it names?
- Hint 1: What could the bank publish where any mail server can look it up?
Show what happens
The bank could publish, in advance, which servers may send its mail and a key for checking signatures, and say what to do with mail that fails. That is what the three controls below do.
Three email-authentication controls help receiving mail systems detect forged senders. All three are published in the sending domain’s DNS records, and they work together.
- SPF (Sender Policy Framework) specifies the authorised sending infrastructure for a domain. The domain owner publishes which servers may send its mail, and a receiving server checks whether the message came from one of them.
- DKIM (DomainKeys Identified Mail) provides a cryptographic signature. The sending system signs the message; the receiver uses a public key published in DNS to verify that the signing domain really sent it and that the signed content has not been altered on the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. It requires at least one of them to pass in alignment with the domain in the visible From address, tells receiving systems how to handle messages that fail (deliver, quarantine or reject), and sends reports back to the domain owner.
“Alignment” is the important word. SPF and DKIM can each pass for a domain the reader never sees. DMARC ties the result to the From address that the reader does see.
Follow one forged message through the checks. An attacker sends an email that claims to come from the accounts team at harbourbank.example, a fictional bank, from a mail server the bank has nothing to do with.
Five steps made by the receiving mail server before the message reaches anyone’s inbox. The bank, its domain and the message are fictional.
Receiving mail server
Step 1 of 5: Look up the sender’s published records
The visible From address says harbourbank.example, so the server asks DNS for that domain’s SPF, DKIM and DMARC records.
Receiving mail server
Step 2 of 5: SPF: did it come from a listed server?
The bank’s SPF record lists the servers allowed to send its mail. The message came from a server that is not on the list. SPF does not pass for harbourbank.example.
Receiving mail server
Step 3 of 5: DKIM: is there a valid signature from that domain?
Genuine mail from the bank carries a signature that can be checked with the bank’s public key in DNS. This message has no such signature. DKIM does not pass for harbourbank.example.
Receiving mail server
Step 4 of 5: DMARC: did either check pass for the From domain?
Neither did. The bank’s DMARC record tells receivers what to do in that case: reject the message.
Receiving mail server
Step 5 of 5: Act on the policy
The message is rejected and never reaches an inbox. A report of the failure goes back to the bank, which learns that someone is forging its domain.
Every step depends on records the real domain owner published. A domain with no DMARC record gives the receiving server no instruction to follow.
Change one fact. The attacker registers harbourbnak.example, with two letters swapped, and sends from there. The attacker owns that domain, so they publish their own SPF, DKIM and DMARC records for it. Now all three checks pass, correctly: the message really did come from harbourbnak.example. It is delivered. The checks did their job, which is to stop a domain being forged; they cannot tell that the domain was chosen to deceive. Noticing the swapped letters is left to the reader.
These controls stop someone forging your exact domain. They do not stop a message from a lookalike domain, which the attacker owns and can configure correctly, and they do not stop a message sent from a genuinely compromised mailbox, which is authentic as far as the mail system can tell. They also say nothing about whether the content is honest.
Stage: Predict
Business email compromise
Think it through
Show the answer
Answer: B. Check with the head teacher directly.
Check through a channel already known to be genuine. Authority, urgency and secrecy, with nothing for a filter to catch, are the marks of this kind of attack.
Business email compromise (BEC) is a targeted, business-focused social-engineering and fraud attack involving the impersonation or compromise of trusted business identities or accounts.
Examples:
- CEO fraud: a message apparently from a senior executive instructs someone to make a payment.
- A fake urgent transfer request: the money must be sent today, and discreetly.
- A supplier bank-detail change: a message apparently from a real supplier asks for future invoices to be paid into a new account.
- A compromised mailbox used inside an existing thread: the attacker replies within a genuine conversation, so everything about the message looks right.
A memory aid:
BEC = trusted business identity + convincing request + financial or data loss
Its common ingredients are authority, urgency, impersonation, spoofing and compromised accounts. BEC often contains no link and no attachment, so there is nothing for a malware filter to catch. The defence is mainly process: confirm any change of bank details or unusual payment by calling a number already held on file, and require a second person to approve payments.
A school pays a catering supplier, Greenway Foods, every month. The finance officer, Mrs Patel, receives an email in the usual thread with the supplier.
- The request. “We have changed bank. Please pay this month’s invoice, and all future ones, into the account below. Our old account closes on Friday.” The sender’s name and signature are the ones Mrs Patel always sees.
- What it relies on. Trust in a familiar name, and urgency: the Friday deadline discourages checking. There is no link and no attachment, so no filter has anything to catch.
- The call-back. The school’s procedure says a change of bank details is never accepted by email alone. Mrs Patel phones Greenway Foods on the number in the school’s supplier records, not the number in the email.
- What the call shows. Greenway Foods has not changed bank. The email came from a lookalike address.
- The second approver. Even if Mrs Patel had been deceived, the school’s payment system needs the business manager to approve any new payee, which gives a second person the chance to ask the same question.
- Result. No money is sent. Mrs Patel reports the email, and the school warns Greenway Foods that someone is impersonating it.
Why it worked: nothing technical stopped this attack. A rule about how changes are confirmed, followed by one person and backed by another, did.
Stage: Check
Legitimate persuasion and deceptive persuasion
Social engineering uses the same skills as honest persuasion. People interested in this side of the subject sometimes read more widely about behaviour, influence and negotiation. Two examples:
- Chase Hughes, an author and trainer on behaviour and influence, whose material includes the Neuro-Cognitive Intelligence (NCI) courses and a book, The Ellipsis Manual.
- Chris Voss, a former FBI hostage negotiator and author on negotiation, who writes and speaks about rapport, persuasion and communication.
These are supplementary behavioural resources. They are not Security+ frameworks, security standards or exam authorities, and nothing in this lesson depends on them.
Ideas from negotiation that connect to this lesson include:
- rapport: building a sense of connection;
- mirroring: repeating a few of the other person’s words, which encourages them to say more;
- labelling: naming the other person’s feelings aloud;
- calibrated questions: open questions that steer a conversation without making demands;
- influence more generally.
Legitimate negotiation techniques are not inherently malicious. Salespeople, managers, doctors and negotiators use them every day. They become a cybersecurity concern when they are used deceptively to obtain access, data or compliance. Knowing how they work is useful for a defender for the same reason that knowing how a lock is picked is useful to a locksmith.
Check your understanding
Show the answer
Answer: C. Not by itself: only when used to deceive.
Not by itself. Rapport and mirroring are everyday skills; they become social engineering when used deceptively to obtain access, data or control.
Stage: Explain
Defending against social engineering
No single control stops social engineering. The layers that help:
- Verify through a known channel. Check an unexpected request by contacting the person or organisation through details you already hold, never through details given in the message or call.
- Slow down. Urgency is the attacker’s tool. A genuine request survives a five-minute check.
- Make reporting easy and blame-free. A quickly reported click can be contained. A hidden one cannot.
- Add technical controls. MFA limits the value of a stolen password; email filtering and DMARC remove many forged messages before anyone sees them.
- Add process controls. Two people to approve a payment; a fixed procedure for changing supplier bank details.
- Train with realistic examples, so that people recognise the triggers in the table in “Why it works”.
Stage: Explain
Security+ terminology
The CompTIA Security+ SY0-701 exam objectives (objective 2.2) list these under human vectors/social engineering: phishing, vishing, smishing, misinformation/disinformation, impersonation, business email compromise, pretexting, watering hole, brand impersonation and typosquatting.
Spear phishing, whaling, pharming and angler phishing are not named in that list, but they are standard vocabulary and appear widely in study material. The objectives also treat the message channel (email, SMS, instant messaging, voice call) as a threat vector in its own right.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Take the message one part at a time: who is asking, what others are said to have done, and when.
Show the answer
Answer: B. Authority, social pressure and urgency.
Authority (the IT team), social pressure (everyone else has done it) and urgency (now). The right response is to check with IT through a channel you already trust.
Apply it
Show the answer
Answer: C. They stop forgery of our domain, not lookalikes.
The controls stop someone forging your exact domain. They do not stop a lookalike domain the attacker owns, or mail from a genuinely compromised mailbox.
Stage: Check
Check your understanding
These questions come from the approved revision bank. They were approved under the site’s approval workflow, which includes owner-authorised delegated review: not every question was read individually by the site owner.
Social engineering, impersonation and pretexting
Show answer
Answer: Trust and human psychology
Social engineering exploits trust and human psychology: it targets the human, not just the technology, manipulating people into actions such as revealing passwords, disclosing codes, clicking links or transferring money. Unpatched software, weak encryption and misconfigured devices are technical weaknesses. A social engineer may use them afterwards, but the technique itself works on people.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: The story that the account has an urgent problem needing a code
Impersonation is who the attacker pretends to be, and pretexting is the believable story or scenario used to justify the request. The claim to be from IT support is the impersonation. The invented account problem that supposedly needs a code is the pretext. The code is what the attacker wants, and the telephone call is the channel. The example also uses authority and urgency to discourage checking.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Authority; Urgency
Common psychological triggers include authority, urgency, fear, curiosity, trust, helpfulness, familiarity, reciprocity and social pressure. Naming the finance director uses authority, because people comply with those in charge. The one-hour deadline uses urgency, because hurry leaves no time to check. Nothing in the message offers a favour to be returned, which would be reciprocity, or tempts the reader to find something out, which would be curiosity.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: False
False. Rapport, persuasion and negotiation techniques are legitimate skills, used every day in sales, management, medicine and negotiation. They become a security concern only when they are used deceptively to obtain access, data or compliance. What makes social engineering harmful is the deception and the purpose, not the skills. Understanding those skills helps a defender recognise when they are being misused.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Decline, end the call and contact IT support on a number already known to be genuine
Social engineering manipulates people into actions such as disclosing multi-factor authentication codes, and an unexpected request for a code should be verified through a separately known channel. A caller who knows a code was sent may have triggered it by signing in with a stolen password. Ringing back on a number the caller supplies verifies nothing, because the attacker controls that number, and part of a code is still part of a secret.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Phishing and related techniques
Show answer
Answer: Spear phishing
Phishing is broad deceptive messaging sent to many people, while spear phishing is targeted and personalised at a specific person or group. The use of the officer’s name, a real project and a real supplier shows research and targeting, so this is spear phishing. Angler phishing uses fake support accounts on social media, pharming redirects users without a message, and smishing arrives by SMS text message, whereas this arrived by email.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Smishing: SMS text message. Vishing: voice call.
Smishing is phishing by SMS text message and vishing is phishing by voice call. The names are built from the channel: SMS plus phishing, and voice plus phishing. The deception is the same in each case; only the route by which it reaches the victim changes.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Pharming
Pharming redirects users to a fraudulent destination, classically by manipulating DNS or other name resolution. The customer typed the correct address and clicked nothing, so no deceptive message was involved and this is not phishing. Vishing is phishing by voice call. Typosquatting depends on a lookalike address that the user mistypes or misreads, whereas here the address was right and the traffic was redirected.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Typosquatting
Typosquatting is registering a domain deliberately similar to a legitimate one, so that users mistype it or fail to notice the difference. That is what the swapped letters achieve. Pharming would send users to the wrong place even when they typed the right address. A watering-hole attack compromises a genuine site the targets visit, and angler phishing uses fake support accounts on social media.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: A watering-hole attack
In a watering-hole attack the attacker compromises a website the intended targets already visit and waits for them. Spear phishing does the opposite: it goes to the target with a personalised message. No message was sent here. Typosquatting relies on a lookalike address, whereas this is the association’s genuine site, and smishing arrives by SMS text message.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Angler phishing
Angler phishing uses fake customer-support accounts on social media to hook people who are already asking a company for help. The public complaint tells the attacker who to approach, and the fake support reply is the bait. Pharming redirects web traffic, a watering-hole attack compromises a website the targets visit, and vishing is carried out by voice call.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Whaling
Whaling is spear phishing aimed at senior or high-value individuals: the big fish. It is still phishing, and still targeted, but the choice of target is what earns the name. Smishing is phishing by SMS text message, pharming redirects users to a fraudulent destination, and pretexting is the believable story used to justify a request in many kinds of social engineering.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: False
False. Pharming redirects users to a fraudulent destination, classically by manipulating DNS or other name resolution, and needs no message or click. The user can type the correct address and still arrive at the wrong site. Phishing is the technique that depends on a deceptive message. The shortcut is that phishing tricks the person, while pharming redirects the traffic.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Email spoofing and business email compromise
Show answer
Answer: Business email compromise
Business email compromise is a targeted fraud that impersonates or compromises a trusted business identity or account to make a convincing request, such as a change of supplier bank details. A compromised supplier mailbox replying inside a real thread is a clear case. Smishing arrives by SMS text message, a watering-hole attack compromises a website, and typosquatting relies on a lookalike domain.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Display-name spoofing
Email spoofing takes several forms. In display-name spoofing the name shown is a trusted one while the address behind it is unrelated, which is what happened here. Reply-To manipulation leaves the sender looking genuine and redirects the replies. A compromised legitimate account would send from the chief executive’s real address. Pharming is not a form of email spoofing: it redirects users to a fraudulent website.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: SPF lists authorised sending servers; DKIM adds a cryptographic signature; DMARC sets policy and reporting
SPF publishes which servers are authorised to send mail for a domain. DKIM adds a cryptographic signature, so the receiver can verify that the signing domain sent the message and that the signed content has not been altered. DMARC builds on both, requiring alignment with the visible From domain, telling receivers how to handle failures and providing reporting. None of the three encrypts messages, scans attachments or blocks links.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Alignment with the visible From domain, a policy for failures and reporting
DMARC builds on SPF and DKIM. It requires at least one of them to pass in alignment with the domain in the visible From address, tells receiving systems how to handle messages that fail, and sends reports back to the domain owner. Alignment matters because SPF and DKIM can each pass for a domain the reader does not see. DMARC does not encrypt mail, scan attachments or authenticate the person sending.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: False
False. Email authentication does not stop a fraudulent message sent from a genuinely compromised mailbox. The message really does come from the supplier’s domain and servers, so it passes every check. The same is true of a lookalike domain that the attacker controls and has configured correctly. These controls stop someone forging an exact domain; they say nothing about whether the content is honest.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Show answer
Answer: Confirming the change by calling a number already held on file; Requiring a second person to approve payment changes; Protecting staff mailboxes with multi-factor authentication
The defences against business email compromise are verifying requests through a separately known channel, requiring a second approver, and protecting mailboxes with multi-factor authentication so that they are harder to take over. Replying to the email asks the attacker, who controls the conversation, to vouch for themselves. A display name is free text that the sender chooses, so a correct-looking name confirms nothing.
Revision sources: Social Engineering and Phishing (Supplementary Study Guide explanation)
Study and revision
Practise through the Threat Actors & Attack Vectors topic. Questions cover what social engineering exploits, impersonation and pretexting, psychological triggers, each phishing variant, pharming, typosquatting, watering-hole attacks, email spoofing, SPF, DKIM and DMARC, and business email compromise; ten flashcards recall the definition of social engineering, the impersonation and pretexting distinction, the four phishing shortcuts, the role of each email-authentication control and the BEC memory aid. Items that use this lesson’s supplementary explanation say so. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objectives 2.2, 4.5 and 5.6 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- Social engineering works on people, not technology, by pulling ordinary reactions such as urgency, fear and trust in authority.
- A message that rushes, frightens or flatters you is a reason to slow down and verify through a channel you already trust.
- Impersonation is who they pretend to be; pretexting is the story. The phishing family differs by target and channel.
- Pharming redirects, typosquatting relies on a lookalike name, and a watering hole waits where targets already go.
- SPF, DKIM and DMARC stop forgery of your exact domain; business email compromise is stopped mainly by process.
Key terms
- Social engineering
Manipulating people, by exploiting trust and human psychology, into doing something that helps an attacker, such as revealing a password or making a payment.
- Impersonation
Pretending to be someone the target trusts, such as a colleague, a manager, IT support or a supplier.
- Pretexting
Inventing a believable story or scenario that gives the target a reason to comply with a request.
- Phishing
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
- Spear phishing
Phishing that is targeted at a specific person or group and personalised to be convincing.
- BEC (Business Email Compromise)
A targeted fraud that impersonates or compromises a trusted business identity or email account in order to make a convincing request, typically for a payment or for sensitive data.
Common misunderstandings
It works on ordinary reactions such as helpfulness and respect for authority. A well-researched, well-timed message can catch anyone.
Impersonation is who the attacker claims to be. Pretexting is the story that makes the request seem reasonable.
Pharming needs no message and no click. The user asks for the right address and is redirected.
The channel varies: SMS is smishing, a voice call is vishing, and social media has its own forms.
A display name is free text. Check the address, and remember that a compromised real account sends real-looking mail.
Further reading
- NCSC: Phishing attacks: defending your organisation: layered defences against phishing, including spear phishing and whaling.
- NCSC: Email security and anti-spoofing: what SPF, DKIM and DMARC do and how to set them up.
- MITRE ATT&CK: Phishing (T1566): how phishing is recorded as an adversary technique.
- CompTIA Security+ SY0-701 exam objectives (PDF): objective 2.2 lists the human vectors quoted in the Security+ terminology step.
- Supplementary behavioural resource, not an exam authority: Chase Hughes.
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 8 (see the Session 8 Learning Log): social engineering as the exploitation of trust and human psychology; impersonation and pretexting; phishing, spear phishing, smishing, vishing, pharming, typosquatting, watering-hole attacks and angler phishing; email spoofing and business email compromise; and Chase Hughes and Chris Voss as supplementary behavioural resources.
- Accuracy qualifications: pharming is not limited to DNS spoofing, which is its classic example; the behavioural and negotiation resources are supplementary and are not Security+ frameworks or exam authorities; legitimate persuasion techniques are not inherently malicious; and email authentication does not stop lookalike domains or compromised accounts.
- Independently checked: the descriptions of SPF, DKIM and DMARC against the NCSC’s email security guidance, and the Security+ wording against the published SY0-701 objectives. These are external references, not course evidence.
- Supplementary explanation: the opening comparison, the list of things people are manipulated into doing, the table of psychological triggers and its wording, the IT-support example, the definitions and shortcuts for each technique, whaling, the explanation of how DNS redirection works, the fictional lookalike domains, the trade-association example, the at-a-glance table, the forms of email spoofing, the explanations of SPF, DKIM, DMARC and alignment, the BEC examples and process defences, the negotiation ideas, the defensive measures, the step-by-step walk through one forged email and its lookalike-domain variation, the fictional supplier bank-details example, the Security+ terminology note and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The step-through diagram is original.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the locked-door opening questions, every question asked in the lesson with its feedback and hints, the blocked-card, helpdesk, parcel, council, engineer, gift-card, salesperson, chat-app and email-authentication examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. Every message, call, organisation and domain in this lesson is fictional. I have not carried out or investigated a social-engineering attack, and I have not configured email authentication.
Phishing on social media in which the attacker poses as a company’s customer-support account and approaches people who are asking that company for help.
Every point where an attacker could interact with, or try to get into, an organisation, system or application.
The route or method an attacker uses to reach a target, such as a phishing email, stolen remote-access credentials or an infected removable drive.
A targeted fraud that impersonates or compromises a trusted business identity or email account in order to make a convincing request, typically for a payment or for sensitive data.
Meeting applicable legal, contractual and internal requirements.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
Obtaining someone’s sign-in details, such as a username and password, without authorisation.
An email-authentication control that adds a cryptographic signature to a message, so the receiver can verify that the signing domain sent it and that the signed content has not been altered.
A policy, published in DNS, that builds on SPF and DKIM: it requires one of them to pass in alignment with the visible From domain, tells receivers how to handle messages that fail, and provides reporting.
The system that translates domain names into IP addresses. It commonly uses port 53 over UDP and TCP.
Forging part of an email, such as the display name or the sender’s address, so that the message appears to come from someone else.
Pretending to be someone the target trusts, such as a colleague, a manager, IT support or a supplier.
Malicious software designed to disrupt, damage or gain unauthorised access to devices, networks or data. Ransomware is one type.
Authentication that requires two or more different types of factor, such as something you know and something you have.
Redirecting users to a fraudulent destination even when they enter the correct address, classically by tampering with DNS or other name resolution.
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
Inventing a believable story or scenario that gives the target a reason to comply with a request.
Step-by-step instructions explaining how a particular task should be carried out.
The half of a key pair that can be given to anyone. It encrypts data for the key’s owner and verifies the owner’s signatures.
Phishing carried out by SMS text message.
Phishing that is targeted at a specific person or group and personalised to be convincing.
An email-authentication control in which a domain publishes, in DNS, which servers are authorised to send mail on its behalf.
A control implemented or enforced by technology, such as multi-factor authentication, encryption or a firewall.
Registering a domain name deliberately similar to a legitimate one, so that people who mistype it, or do not notice the difference, arrive at the attacker’s site.
Phishing carried out by voice call.
Compromising a website that the intended targets already visit, and waiting for them to come to it.
Spear phishing aimed at senior or high-value individuals, such as executives or board members.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.