Social Engineering
The most sophisticated network defence in the world can be bypassed with a single convincing phone call. Social engineering exploits people, not systems - and it's consistently the most effective attack vector in real-world cybercrime.
The hacker never touched the network firewall. They never exploited a software vulnerability. They called the receptionist, said they were from IT support, explained there was an urgent server issue that needed the network admin's login credentials immediately. The receptionist gave them to a complete stranger over the phone. The entire company network was compromised in minutes.
Social engineering questions appear on every specification. The most commonly confused terms are phishing vs blagging. Phishing uses digital messages (email); blagging is a fabricated story or pretext (often verbal or written). Examiners will test you on the difference.
What is social engineering?
Social engineering is the manipulation of people into performing actions or revealing confidential information. Instead of attacking software and hardware, attackers exploit human psychology - trust, fear, urgency, and helpfulness.
Security professionals often say: "The weakest link in any security system is the human." Even the most technically hardened network can be compromised if an employee is manipulated into handing over access credentials.
The four social engineering attacks
Fraudulent messages - almost always emails - that impersonate trusted organisations (banks, government, employers) to trick recipients into clicking malicious links, entering credentials, or downloading malware.
Spear phishing is a targeted variant using personalised details (your name, your employer, a real invoice number) to appear highly convincing. Smishing uses SMS; vishing uses phone calls.
Creating a fabricated scenario (a pretext) to manipulate someone into providing information or access. The attacker invents a plausible story and a false identity to gain trust. Unlike phishing, blagging is typically direct and conversational - in person, by phone, or via written correspondence.
Example: calling a company pretending to be from IT support, claiming there is an urgent server issue, and asking for the network password to "fix it".
Physically observing someone as they enter sensitive information. This could be watching someone type a PIN at a cashpoint, a password on a laptop in a café, or a security code at a gate. Simple, low-tech, but consistently effective in the right environment.
Modern shoulder surfing can also involve recording video covertly - a phone propped up on a table, for example.
Luring victims with something enticing. The classic example is leaving infected USB drives in a company car park or reception labelled "Salary Data 2024" or "Confidential". Curious employees plug them in, installing malware. Digital baiting uses online downloads - free software, cracked games, pirated films - as the lure.
Phishing Email Spotter - find the red flags
Below is a realistic phishing email. Click on any element you think is a red flag - a suspicious part of the email that suggests it is not genuine. Find all 5 red flags.
Dear Valued Customer,
Our records indicate you are eligible for a tax refund of £842.50. To process your refund, we require you to verify your identity within 24 hours or the refund will be permanently cancelled.
Please click the link below to verify your details and claim your refund:
www.gov-uk-tax-refund-claim-secure.com/verify
If you do not complete verification within 24 hours, legal proceedings may be initiated against you.
Regards,
HM Revenue & Customs Digital Services Team
A company installs the most advanced technical security system available - firewalls, encryption, and intrusion detection. Explain why social engineering attacks may still succeed, and suggest two measures the company could take to reduce this risk.
Measure 1 - Staff training: Regular security awareness training teaches employees to recognise social engineering attempts, verify identities before sharing information, and follow procedures even under apparent time pressure.
Measure 2 - Clear security policies: An Acceptable Use Policy and clear protocols (e.g. "IT will never ask for your password by phone") gives employees a framework to fall back on when pressured. Staff should know they can refuse requests that violate policy, even from apparent authority figures.
Practice what you have learned
Three levels of worksheet for this lesson. Download, print and complete offline.