Social engineering: phishing

The idea

Phishing is a social-engineering attack that tricks a person into handing over information or access. The attacker sends a message — usually email, but also text or a direct message — that pretends to come from a trusted organisation such as a bank, a school or a delivery firm. The message pressures the recipient to click a link, open an attachment or reply with credentials. The fake link leads to a spoofed login page that captures the password, or the attachment installs malware. Phishing targets the human, not a technical flaw, so the defence is vigilance: check the sender address, hover over links before clicking, and never enter credentials from a link in an unexpected message.

What earns the marks

• Defines phishing as a social-engineering attack that deceives a person into revealing information or access.
• Identifies a typical channel: email, text message or direct message impersonating a trusted source.
• Explains the mechanism: a deceptive link or attachment leads to a fake login page or installs malware.
• States the goal: stealing credentials, personal data or gaining unauthorised access.
• Recognises that phishing exploits human trust rather than a software vulnerability.
• Suggests a defence such as checking the sender, verifying links or reporting suspicious messages.

Common mistakes and how to put them right

• Confusing phishing with a technical network attack.

  Put it right: Correct the misunderstanding by stressing that phishing manipulates the person, not the hardware.

• Assuming phishing only happens by email.

  Put it right by noting text messages and direct messages are also used.

• Thinking the fake page is the real site.

  Put it right by explaining the link leads to a spoofed page that captures what is typed.

• Believing antivirus alone stops phishing.

  Put it right by explaining user vigilance is the key defence.

Exam tips

• Read the scenario and name the specific trick used, such as a fake sender or urgent request.
• Link the attack to its consequence, for example stolen passwords or malware installation.
• When asked for prevention, give a concrete action such as checking the sender address before clicking.