Social engineering: Explain the following forms of social engineering:

The idea

Social engineering means manipulating people into giving away information or access, rather than attacking hardware or software directly. The AQA specification names four forms to explain: phishing, pharming, shoulder surfing and blagging (pretexting). Phishing sends fraudulent messages, often email, that pretend to be a trusted organisation and push the recipient to reveal passwords or click a malicious link. Pharming redirects a user to a fake website without their knowledge, typically by corrupting DNS records or altering a local hosts file, so even typing the correct address can land on a spoofed page. Shoulder surfing is direct observation, such as watching someone type a PIN or read a screen in a public place. Blagging, also called pretexting, is inventing a believable story or false identity to persuade a person or helpdesk to hand over data.

What earns the marks

• Phishing: fraudulent emails or messages impersonating a trusted source to trick the recipient into revealing credentials or clicking malicious links.
• Pharming: redirecting a user to a fraudulent website without their knowledge, for example by corrupting DNS records or editing a hosts file.
• Shoulder surfing: directly observing a person, such as watching them enter a PIN or read a screen, to obtain information.
• Blagging (pretexting): inventing a false story or identity to persuade someone to disclose information or grant access.
• Correctly distinguishing pharming from phishing: pharming does not require the victim to respond to a message; the redirection happens automatically.

Common mistakes and how to put them right

• Confusing pharming with phishing.

  Put it right: Phishing relies on the victim acting on a fraudulent message, whereas pharming silently redirects traffic to a fake site.

• Describing shoulder surfing as a software attack.

  Put it right: It is direct physical observation of a person's screen or keypad.

• Treating blagging as a technical exploit.

  Put it right: It is deception through a fabricated story or false identity aimed at a person.

Exam tips

• Link each form to the human behaviour it exploits, not just a one-word definition.
• For pharming, state the mechanism (DNS or hosts file manipulation) to show understanding beyond 'fake website'.
• Use the specification term 'blagging' and add 'pretexting' to show precise vocabulary.