What you'll learn
- The psychology of manipulation
- Common attack types
- Spotting a phish
- Building security culture
Lessons
1The psychology of manipulation
Social engineers use Cialdini's principles: authority ("this is the CEO"), urgency/scarcity ("in the next 30 minutes"), social proof, liking, reciprocity and commitment. Any message that combines urgency with an unusual request deserves a pause.
2Common attack types
- Phishing email, spear phishing (targeted), whaling (executives).
- Vishing (voice, now including AI voice clones) and smishing (SMS).
- BEC: fake invoices or bank detail changes.
- MFA fatigue: repeated push prompts until someone approves.
- Help-desk impersonation to reset passwords or MFA.
- ClickFix: fake CAPTCHA or error pages telling users to paste a command.
3Spotting a phish
Check the real sender domain (not just the display name), hover links before clicking, be wary of look-alike domains (rn vs m, extra hyphens), unexpected attachments, and requests to bypass normal process. When in doubt, verify through a known channel such as a phone number you already have.
4Building security culture
Short, frequent training beats annual lectures. Make reporting easy (a report-phish button), thank reporters, measure report rate rather than just click rate, and never shame people who click. Processes matter too: callback verification for payment changes defeats most BEC.
Hands-on lab: Play the Phishing Spotter in the Cyber Range
- Open Cyber Range → Phishing Spotter.
- Classify each message as phishing or legitimate.
- Read every explanation, even for ones you got right.
- Note which red flag fooled you.
- Write a 5-line tip sheet for colleagues based on your mistakes.
Outcome: Practical phishing recognition plus an awareness handout.
Practice questions
'Your account will be closed in 1 hour' uses which principle?
Answer: Urgency/scarcity. Time pressure stops careful thinking.
Best defense against bank-detail-change BEC?
Answer: Callback verification using a known number. Out-of-band verification defeats the scam.
A user gets 20 MFA prompts at night. They should…
Answer: Deny and report immediately. It's MFA fatigue; their password is likely compromised.
The full graded assessment (5 questions, pass mark 70%) is in the platform.
Key terms
- Phishing
- Fraudulent messages that trick people into revealing data or running malware.
- Spear phishing
- Phishing targeted at a specific person using researched details.
- BEC
- Business Email Compromise: impersonation to redirect payments or data.
- Vishing
- Voice phishing, increasingly using AI voice clones.
- Pretexting
- Inventing a believable scenario to obtain information.
- MFA fatigue
- Flooding a user with push prompts until they approve one.
- Tailgating
- Following an authorized person through a secured door.
- ClickFix
- Fake CAPTCHA or error pages that trick users into running pasted commands.
See the full cyber security glossary →
Official references
Related courses
Security Awareness for Employees
Short, practical training every employee needs: data handling, phishing, remote work, AI at work and reporting incidents.
Cyber Safety for Students
Age-appropriate online safety: strong passwords, spotting scams, privacy, kindness online and where to get help.