Learning Objectives
- Identify phishing, smishing and vishing attempts.
- Recognise fake websites, invoice scams and impersonation.
- Check suspicious links and attachments safely.
- Respond correctly after a risky click or reply.
Module 3
Phishing, Scams and Social Engineering
Learn to spot manipulative messages and fake requests before they become security incidents.
Why This Matters
Many attacks start by exploiting trust and urgency rather than technical weaknesses.
Strong awareness reduces both personal loss and business disruption.
Plain-Language Explanation
Social engineering is psychological manipulation used to get people to disclose information or take risky actions. Common signs include urgency, fear, pressure to bypass normal process, and subtle details that do not match normal business communication. Always verify requests through a trusted channel.
If you clicked something suspicious: disconnect
if necessary, report quickly, run a security scan, and reset
credentials from a known-safe device.
Practical Examples
- Phone call claims to be from a bank asking for OTP codes.
- Email invoice appears urgent but account number changed.
- SMS parcel message asks you to open a shortened link.
Common Mistakes
- Trusting display names without checking sender details.
- Opening attachments before verifying the request.
- Assuming only inexperienced users are targeted.
Security Checklist
Module checklist progress0%
Short Knowledge Check
Question 1: What is smishing?
Scam or phishing attempts delivered by SMS or messaging platforms.
Question 2: Why verify payment-change requests verbally?
Email accounts can be spoofed or compromised; verbal confirmation reduces fraud risk.
Question 3: Should reporting be delayed until you are sure?
No. Early reporting helps reduce impact even when uncertainty exists.
Key Takeaways
- Attackers often target behaviour, not just technology.
- Verification habits are critical for fraud and phishing prevention.
- Fast response after suspicion can prevent wider damage.