Social Engineering and Phishing

Lesson plan

Level

Beginner

Time

About 100 minutes; the steps below add up to 102

Learners decide whether forcing a lock or persuading the key holder is easier, and recall a message that pushed them to act, so the idea of working on people, and the levers used, come from them before any term. Predictions then precede the difference between who a caller claims to be and their story, why a personalised email works better than a broad one, how you could reach a fake site by typing the right address, where an attacker could wait for careful engineers, how a mail server could check a sender, and what to do with an urgent gift-card request. The habit to build: when a message rushes, frightens or flatters you, slow down and verify through a channel you already trust.

Objectives

• Explain social engineering as exploiting trust and ordinary human reactions
• Recognise the psychological triggers a message or call pulls
• Tell impersonation from pretexting, and the members of the phishing family apart
• Explain pharming, typosquatting, watering holes and email spoofing, and what SPF, DKIM and DMARC do and do not stop
• Defend against business email compromise with process as well as technology

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Attack Surfaces and Attack Vectors lesson first.
• Do not use real phishing emails that contain live links, or anyone’s real details. If you show examples, use screenshots you have made safe.
• The lesson takes about 102 minutes. To teach it in two parts, stop after “Email spoofing”; the second part opens with “Business email compromise”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain social engineering as exploiting trust and ordinary human reactions
   • Recognise the psychological triggers a message or call pulls
   • Tell impersonation from pretexting, and the members of the phishing family apart
   • Explain pharming, typosquatting, watering holes and email spoofing, and what SPF, DKIM and DMARC do and do not stop
   • Defend against business email compromise with process as well as technology

   Purpose: Learners decide whether forcing a lock or persuading the key holder is easier, and recall a message that pushed them to act, so the idea of working on people, and the levers used, come from them before any term. Predictions then precede the difference between who a caller claims to be and their story, why a personalised email works better than a broad one, how you could reach a fake site by typing the right address, where an attacker could wait for careful engineers, how a mail server could check a sender, and what to do with an urgent gift-card request. The habit to build: when a message rushes, frightens or flatters you, slow down and verify through a channel you already trust.

2. 1. The person with the key Think 6 min

   Purpose: Find the idea of working on people, and the levers used, from learners’ own experience.

   Ask

   • Forcing the lock or persuading the key holder: which is easier?
   • What did a message that rushed you do to make you act?

   Responses to expect

   • Real examples come quickly: parcel texts, “your account is locked”, fake bosses.
   • On screen in turns: the opening question, its answer; then the question on a message that rushed you, and its answer.

   Discussion pause: Collect two or three real examples before revealing the explanation; list the levers they used.

   In the lesson window

   • Think it through: Which is usually easier for an intruder: forcing a well-locked door, or persuading the person who holds the key to open it?
   • Think it through: Think of a time a text, call or email tried to get you to do something quickly. What did it do to make you want to act?

3. 2. The idea Explain 6 min

   Purpose: Define social engineering and what attackers manipulate people into doing.

   Ask

   • Why are helpfulness and trust, which are good qualities, a route in?

   Responses to expect

   • Because a real, authorised person acting satisfies many technical controls.
   • On screen in turns: the opening; then why people are part of the attack surface; what attackers manipulate people into; why social engineering satisfies technical controls.

4. 3. Why it works: psychological triggers Check 9 min

   Purpose: Name nine triggers, and the personal rule that follows from them.

   Ask

   • The blocked-card text: which two triggers?

   Responses to expect

   • Most get fear and urgency.
   • On screen in turns: the opening; then the common triggers, with what each relies on held back; what each trigger relies on, and how it might sound; a personal rule that follows from the triggers; the check question on the blocked card, and its answer.

   Misconceptions to challenge

   • A learner may believe: “Only foolish people fall for social engineering.” Respond: It relies on ordinary, predictable reactions.

   Discussion pause: The table shows only the trigger names at first: ask the class what each relies on and for an example, then reveal.

   To go further

   • Rewrite the blocked-card text so that it pulls three different triggers instead.

   In the lesson window

   • Check your understanding: A text says: “Your bank card has been blocked. Call this number within 15 minutes or lose access to your account.” Which two triggers does it pull?

5. 4. Impersonation and pretexting Predict 7 min

   Purpose: Separate who the attacker pretends to be from the story they tell.

   Ask

   • Sam from the helpdesk: which part is who, and which is the story?

   Responses to expect

   • Learners often call the whole call “impersonation”; point to the virus story as the pretext.
   • On screen in turns: the opening question, its answer; then impersonation and pretexting; the call from IT support, before it is taken apart; the impersonation and the pretext; the triggers, and the right response; impersonation and pretexting side by side; pretexting.

   In the lesson window

   • Think it through: A caller says: “Hi, it’s Sam from the IT helpdesk. We’ve found a virus on your laptop and need your password to clean it.” Which part is who the caller claims to be, and which part is the story?

6. 5. The phishing family Predict 9 min

   Purpose: Distinguish phishing, spear phishing, whaling, smishing, vishing and angler phishing.

   Ask

   • Parcel email or researched invoice email: which fools its reader more often?

   Responses to expect

   • Some argue for the broad email because of its reach; ask about one reader.
   • On screen in turns: the opening question, its answer; then phishing and spear phishing; the two side by side; whaling; smishing and vishing; angler phishing.

   If the explanation does not land: Build each name from its parts: SMS + phishing, voice + phishing, a spear aimed at one fish, a whale as the biggest fish.

   In the lesson window

   • Think it through: One email about “your parcel” goes to 10,000 people. Another, sent to one finance officer, mentions a real supplier and a real invoice number. Which is more likely to fool the person who reads it?

7. 6. Pharming, typosquatting and watering holes Predict 12 min

   Purpose: Distinguish redirecting, lookalike domains and compromising a site the targets already visit.

   Ask

   • How could typing the right address still land you on a fake site?
   • A one-letter-different council site in a text: which techniques?
   • Where could an attacker wait for careful engineers?

   Responses to expect

   • Few know about DNS yet; accept “something sent me the wrong way” and name it.
   • On screen in turns: the opening question, its answer; then pharming; phishing and pharming side by side; typosquatting; the check question on the one-letter-different website, and its answer; the question on engineers who ignore email, and its answer; what a watering-hole attack is; a memory aid: go to the target, or wait where it goes; the techniques at a glance, with what defines each held back; what defines each technique.

   Discussion pause: In the at-a-glance table, the definitions are held back: use it as a quick recall check.

   In the lesson window

   • Think it through: You type your bank’s correct web address and still arrive at a fake copy of the site. How could that happen, without any message tricking you?
   • Check your understanding: A text message links to a website whose name differs from the real council’s by one letter. Which techniques are involved?
   • Think it through: An attacker wants to reach engineers who never open emails from strangers. Where else could the attacker wait for them?

8. 7. Email spoofing Predict 12 min

   Purpose: Explain the forms of email spoofing and how SPF, DKIM and DMARC check senders, using the step-through.

   Ask

   • How could a mail server tell whether a message really came from the bank?

   Responses to expect

   • Learners often suggest the server phones the bank; steer towards information published in advance.
   • Diagram: step through the receiving server’s checks; before each, ask what the server will find for the forged message.
   • On screen in turns: the opening; then common forms of spoofing; the question on telling whether it is really the bank, and its answer; the three controls, starting with SPF; DKIM; DMARC, and why alignment matters; one forged email through the checks; the diagram’s stages one at a time; change one fact: a lookalike domain; why the controls do not solve spoofing.

   Misconceptions to challenge

   • A learner may believe: “With SPF, DKIM and DMARC in place, spoofed email is solved.” Respond: They protect your exact domain, not lookalikes or hijacked real mailboxes.

   In the lesson window

   • Think it through: Email lets the sender set much of what the recipient sees. How could a receiving mail server tell whether a message really came from the bank it names?

9. 8. Business email compromise Predict 9 min

   Purpose: Explain business email compromise and why process is the main defence.

   Ask

   • The gift-card email: what should the office do?

   Responses to expect

   • Some suggest replying to check; ask who would read the reply.
   • On screen in turns: the opening question, its answer; then what business email compromise is, and its forms; the BEC memory aid, and why the defence is process; the supplier bank-detail change, up to what it relies on; the call-back and what it shows; the second approver, the result and why it worked.

   To go further

   • Write the one-sentence rule the school office should follow for any payment request.

   In the lesson window

   • Think it through: An email shows the head teacher’s name and asks the school office to buy £500 of gift cards today and keep it quiet. There is no link or attachment. What should the office do?

10. 9. Legitimate persuasion and deceptive persuasion Check 5 min

    Purpose: Separate everyday persuasion skills from deceptive use, and place the supplementary resources correctly.

    Ask

    • Is the mirroring salesperson a social engineer?

    Responses to expect

    • Most see that intent and deception are the test.
    • On screen in turns: the opening; then ideas from negotiation, and when they become a concern; the check question on the mirroring salesperson, and its answer.

    Misconceptions to challenge

    • A learner may believe: “Learning persuasion techniques is learning to attack.” Respond: The techniques are everyday skills; they become a concern only when used deceptively. Defenders study them as a locksmith studies lock-picking.

    In the lesson window

    • Check your understanding: A salesperson repeats a customer’s own words back to them to build rapport. Is that social engineering?

11. 10. Defending against social engineering Explain 5 min

    Purpose: Summarise the layers of defence.

    Ask

    • Which of the six layers would have stopped the gift-card fraud?

    Responses to expect

    • Verifying through a known channel, and a payment process with two approvers.
    • On screen in turns: the opening; then the layers that help, starting with verification; slowing down; easy, blame-free reporting; technical controls; process controls; realistic training.

    If the explanation does not land: Treat an unexpected request like a stranger at the door claiming to read the meter: you check with the company on a number you already have, not the one on their badge.

12. 11. Security+ terminology Explain 3 min

    Purpose: Map the lesson to the Security+ objectives’ wording.

    Ask

    • Which techniques in the lesson are not named in the objectives’ list?

    Responses to expect

    • Spear phishing, whaling, pharming and angler phishing.
    • On screen in turns: the opening; then standard vocabulary not in the list.

13. 12. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The chat-app message tests triggers; the DMARC claim tests the limits of email authentication.
    • On screen in turns: the opening question, its answer; then the question on DMARC solving it, and its answer.

    In the lesson window

    • Apply it: A message on the staff chat app, apparently from the IT team, says that everyone else in your team has already installed a “security update” from a link, and asks you to do it now. Which triggers does it pull?
    • Apply it: Your organisation has SPF, DKIM and DMARC correctly set up. A colleague says forged email is now impossible. What is the best response?

14. 13. Check your understanding Check 12 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • There are three groups of questions; take one group at a time.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; the next group of revision questions, starting with its first; the second revision question; the third revision question; the fourth revision question; the fifth revision question; the sixth revision question; the seventh revision question; the eighth revision question; the next group of revision questions, starting with its first; the second revision question; the third revision question; the fourth revision question; the fifth revision question; the sixth revision question; where to practise next.

15. 14. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: what is the personal rule from the triggers table?

    Responses to expect

    • A message that rushes, frightens or flatters you is a reason to slow down.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

16. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • People are part of the attack surface, and ordinary reactions are the levers.
    • Rushed, frightened or flattered: stop and check through a channel you already know.
    • Who they claim to be and the story they tell are two separate tricks.
    • Redirect, lookalike, waiting room: three different deceptions about where you are.
    • Email checks protect your own domain; payment rules stop the fraud that gets past them.

Consolidation

• People are part of the attack surface, and ordinary reactions are the levers.
• Rushed, frightened or flattered: stop and check through a channel you already know.
• Who they claim to be and the story they tell are two separate tricks.
• Redirect, lookalike, waiting room: three different deceptions about where you are.
• Email checks protect your own domain; payment rules stop the fraud that gets past them.