Phishing and Social Engineering

How to spot the bait and not bite.

What Is Phishing

Phishing is tricking someone into giving up information or doing something harmful. The attack target is the person, not the software. There's nothing to patch.

Phishing TypeMethodGoal
Email phishingDeceptive emailsSteal credentials, deliver malware
Spear phishingTargeted emailsCompromise specific person
SmishingSMS text messagesSteal info, install malware
VishingVoice callsSteal info, authorize transactions
WhalingTarget executivesLarge financial transfers
Clone phishingCopy legitimate emailsReplace links with malicious ones

How to Spot Phishing

Red Flags in Messages

Red FlagExample
Urgency"Your account will be closed in 24 hours!"
Threats"Pay now or face legal action"
Generic greeting"Dear Customer" or "Dear User"
Suspicious senderamazon-support@gmail.com
Misspellings"Amaz0n" or "Pavpal"
Grammar errorsAwkward phrasing, broken English
Too good to be true"You've won $1,000,000!"
Unusual requests"Send gift cards" or "wire money"

Examining Email Senders

What to CheckHow to Check
Display name vs. actual addressHover over or click on sender name
Domain spelling@amazon.com vs @amaz0n.com
Subdomain tricksamazon.evil.com vs evil.amazon.com
Free email for businessReal companies don't use @gmail.com

Examples of spoofed vs. legitimate:

LegitimatePhishing Attempt
support@amazon.comsupport@amazon-help.com
noreply@chase.comchase-security@gmail.com
alerts@paypal.compaypal.alert@secure-verify.com
security@apple.comapple@security-team.net

Before clicking any link:

StepHow to Do It
Hover over linkSee actual destination URL
Check domain carefullyIs it the real company's domain?
Look for HTTPSLegitimate sites use encryption
Watch for lookalikespaypa1.com, arnazon.com

URL red flags:

Suspicious URLProblem
http://amazon.com.verify.xyz/...amazon.com isn't the actual domain
https://amaz0n.comLetter 'o' replaced with zero
https://amazon-secure.comNot amazon.com
https://bit.ly/abc123Shortened URL hides destination

Examining Attachments

DangerousUsually Safe
.exe, .scr, .batPDF (from known sender)
.zip, .rar (unexpected).docx, .xlsx (from known sender)
.js, .vbsImages (.jpg, .png)
.pdf.exe (double extension)Calendar invites (.ics)

If you weren't expecting an attachment, verify with the sender through another channel before opening it. Email is easy to spoof. A 30-second phone call is not.

Common Phishing Scenarios

Package Delivery Scams

PatternWhat It SaysReality
Fake tracking notification"Package delivery failed"Link leads to credential theft
Customs fee required"Pay $3.50 to release package"Steals credit card info
Schedule redelivery"Update delivery preferences"Collects personal information

Defense: go directly to the carrier's website (USPS, UPS, FedEx, your local post) and paste the tracking number there.

Financial Institution Scams

PatternWhat It SaysReality
Suspicious activity alert"Unusual login detected"Fake login page steals credentials
Account locked"Verify your identity"Collects SSN, account numbers
Security update required"Update your information"Steals banking credentials

Defense: call the bank using the number printed on the back of your card.

Tech Support Scams

PatternHow It Works
Popup warning"Your computer is infected! Call now!"
Cold call"We detected viruses on your computer"
Fake Windows alertScreen freeze with "support" number
Remote access request"Let us fix your computer"

Defense: Microsoft and Apple do not call you out of the blue about your computer. Hang up.

Government Impersonation

PatternWhat It SaysReality
IRS threat"Pay now or be arrested"IRS doesn't threaten via phone/email
Social Security suspension"Your SSN is suspended"SSN cannot be "suspended"
Jury duty warrant"Pay fine to avoid arrest"Courts don't demand payment by phone

Defense: government agencies send physical mail first and never demand same-day payment in gift cards or crypto.

Romance and Relationship Scams

Warning SignWhat's Happening
Met online, never video callsUsing fake photos
Quick emotional attachmentBuilding trust to exploit
Financial hardship storySetup for asking for money
Can't meet in person"Deployed," "overseas," "working abroad"
Requests money or gift cardsThe actual scam

Defense: never send money to someone you haven't met in person. Run a reverse image search on their photos.

AI-Enhanced Phishing

Generative AI made phishing meaningfully harder to spot. The old advice (look for bad grammar, watch for generic greetings) no longer holds:

AI CapabilityImpact on Phishing
Better grammarFewer spelling/grammar red flags
PersonalizationUses your real information from breaches
Voice cloningFake calls sounding like family members
Deepfake videoFake video calls
Automated mass productionMany targeted attacks instead of one generic blast

Defending Against AI Phishing

Old AdviceNew Advice
Look for bad grammarGrammar may be perfect
Verify voice is realEstablish family code words
Trust video callsVideo can be faked
Trust caller IDEasily spoofed
Generic emails are suspiciousTargeted emails are also suspicious

The Verification Process

When something arrives unexpectedly and asks you to act, run this sequence:

Step 1: Stop

Don'tDo
Click immediatelyPause and think
Call number in messageFind official number independently
Reply to senderVerify through other channels
Open attachmentsAsk yourself if you expected this

Step 2: Verify

Verification MethodHow to Do It
Direct websiteType URL manually in browser
Known phone numberUse number from official source
Separate emailContact through known good address
In personAsk face-to-face if possible

Step 3: Report

To ReportWhere
Phishing emailsForward to reportphishing@apwg.org
Suspected scam callsFTC at reportfraud.ftc.gov
IRS impersonationTreasury at phishing@irs.gov
SmishingForward to 7726 (SPAM)
Work-related phishingYour IT security team

Business Email Compromise (BEC)

The FBI tracks BEC as one of the most expensive single categories of cybercrime, costing billions per year. Criminals impersonate executives or vendors and reroute payments:

Attack PatternHow It Works
CEO fraudFake email from CEO requests wire transfer
Invoice manipulationAttacker modifies vendor invoice with new bank details
Account takeoverCompromised email sends real-looking requests
Attorney impersonationFake lawyer requests confidential payment

BEC Red Flags

Warning SignExample
Unusual payment request"Wire money to this new account"
Urgency and secrecy"Don't tell anyone, handle this privately"
Changed payment details"Use these new banking instructions"
Slight email differencesjohn.smith@company.com vs john.srnith@company.com

Defense: any change to payment details gets verified by phone, on a known number, every time.

Protecting Yourself from Phishing

Technical Defenses

DefenseHow It Helps
Email filteringBlocks known phishing
Browser protectionWarns about suspicious sites
2FA on all accountsLimits damage if credentials stolen
Password managerWon't auto-fill on fake sites
Updated softwareBlocks known exploits

Behavioral Defenses

PracticeWhy It Works
Never click email links for sensitive sitesGo directly to site instead
Verify unexpected requestsCall using known number
Check sender carefullyCatch spoofed addresses
Distrust urgencyScammers want you to act fast
Keep personal info privateLess info for targeted attacks

When You Think You've Been Phished

If YouDo This
Clicked a suspicious linkRun antimalware scan
Entered credentialsChange password immediately, enable 2FA
Gave financial infoContact bank, freeze accounts
Installed softwareDisconnect from internet, professional help
Sent moneyContact bank immediately, file police report

Phishing Simulations and Training

Recognizing Real vs. Test

If your employer runs phishing tests:

PurposeBenefit
Identify vulnerable usersGet additional training
Measure security awarenessTrack improvement
Reinforce good habitsPractice skepticism
Test security controlsVerify protections work

Training Your Family

ForTeach
ChildrenNever give information to strangers online
TeensVerify unexpected messages, even from friends
Parents/elderlyScammers impersonate family, call to verify
EveryoneEstablish family code word for emergencies

Family Code Word

Establish a secret word for verifying real emergencies:

SituationUse
Call claiming family emergencyAsk for code word
Message asking for moneyVerify with code word
Video call seems offRequest code word

Make it memorable, secret, and not guessable from anyone's social media.

Evolving Phishing Tactics

QR Code Phishing (Quishing)

AttackHow It Works
Fake parking metersQR code leads to payment theft site
Restaurant menusMalicious code mixed with legitimate
Package deliveriesQR "for tracking" leads to phishing
Email attachmentsQR image bypasses link scanning

Defense: treat QR codes like links. Phone cameras usually preview the URL before opening. Read it.

Calendar Invite Phishing

AttackHow It Works
Spam meeting invitesLinks in invite lead to phishing sites
Auto-accept exploitationInvite appears on your calendar automatically
Fake event reminders"Click to join meeting" link is malicious

Defense: do not click links inside unexpected calendar invites. Delete the invite.

Key Takeaways

  1. Phishing targets people, not software. Technical skill alone won't save you.
  2. Verify on a separate channel. Phone, in person, known address.
  3. Never use the link in the email for a sensitive account. Type the URL yourself.
  4. Urgency is the first red flag. Scammers want you to skip thinking.
  5. Read the sender address. Display names are easy to fake.
  6. AI removed the obvious tells. Grammar and personalization no longer save you.
  7. Pick a family code word. Use it for any emergency money request.
  8. 2FA limits the blast radius. Even with the password, the attacker gets stopped.
  9. Report what you see. Forward phishing to reportphishing@apwg.org or 7726.
  10. When in doubt, wait five minutes. Most attacks rely on you not.

Next Steps

Continue to 05-malware.md for the other side of the attack: what happens once a phishing link, dodgy download, or unpatched program lands code on your device.