Social engineering — AQA GCSE Computer Science

Social engineering encompasses cyber threats that target human behaviour and psychology rather than software vulnerabilities or hardware weaknesses. Cybercriminals manipulate individuals into voluntarily parting with confidential data, granting unauthorised network access, or transferring funds.

Within the AQA GCSE Computer Science specification, this topic forms a crucial part of Cyber Security. Understanding vectors like phishing, blagging, shoulder surfing, and pretexting demonstrates why technical firewalls and encryption alone are insufficient if personnel are not properly trained.

• →Human Vulnerability: People are often the weakest link in computer security due to natural tendencies like trust, urgency, fear, and helpfulness.
• →Phishing: Deceptive communications (typically emails or SMS) masquerading as legitimate entities to harvest credentials or install malware.
• →Blagging (Pretexting): Inventing a fictitious scenario or false identity to manipulate a target into divulging confidential information.
• →Shoulder Surfing: Direct observation of someone entering confidential data, such as PINs or passwords, over their shoulder or via surveillance.
• →Preventative Policies: Non-technical defences including staff awareness training, multi-factor authentication (MFA), clear desk policies, and call-back verification procedures.

• Defines phishing as a social-engineering attack that deceives a person into revealing information or access.
• Identifies a typical channel: email, text message or direct message impersonating a trusted source.
• Explains the mechanism: a deceptive link or attachment leads to a fake login page or installs malware.
• States the goal: stealing credentials, personal data or gaining unauthorised access.
• Recognises that phishing exploits human trust rather than a software vulnerability.
• Suggests a defence such as checking the sender, verifying links or reporting suspicious messages.

• 💡Read the scenario and name the specific trick used, such as a fake sender or urgent request.
• 💡Link the attack to its consequence, for example stolen passwords or malware installation.
• 💡When asked for prevention, give a concrete action such as checking the sender address before clicking.
• 💡Always state the specific human action being exploited when answering questions on how social engineering succeeds.
• 💡Pair every social engineering attack with an appropriate defensive policy: use staff training and 2FA for phishing, and physical privacy filters or shielded keypads for shoulder surfing.
• 💡Be precise with technical terminology; use AQA-recognised terms such as 'phishing', 'blagging', 'pretexting', and 'shoulder surfing'.

• Confusing phishing with a technical network attack: correct the misunderstanding by stressing that phishing manipulates the person, not the hardware.
• Assuming phishing only happens by email: correct this by noting text messages and direct messages are also used.
• Thinking the fake page is the real site: correct this by explaining the link leads to a spoofed page that captures what is typed.
• Believing antivirus alone stops phishing: correct this by explaining user vigilance is the key defence.
• Assuming firewalls and anti-malware can prevent all social engineering: Software cannot stop an employee from being duped into verbally revealing a password or clicking a convincing link on an external site.
• Treating 'blagging' and 'phishing' as identical: While both involve deception, phishing is typically automated and mass-communicated (often digital), whereas blagging involves creating a specific false backstory or persona directly targeting an individual.
• Believing complex passwords prevent shoulder surfing: Complex passwords can still be seen or recorded if an attacker has an unobstructed view of the keyboard or screen.

1. 1Day 1: Learn definitions and key differences between phishing, blagging, and shoulder surfing.
2. 2Day 2: Identify real-world indicators of phishing emails (mismatched URLs, urgent tone, generic greetings).
3. 3Day 3: Review defensive techniques, distinguishing between technical controls (MFA) and non-technical policies (training, verification).
4. 4Day 4: Practise 4-mark and 6-mark scenario questions focusing on mitigation strategies for given business contexts.
5. 5Day 5: Complete past paper active recall questions without notes to solidify correct keywords.

• 📋Identify questions: 1-mark questions asking you to name the attack vector described in a short practical scenario.
• 📋Explain questions: 2-mark to 4-mark questions asking how an attack operates and how a specific method protects against it.
• 📋Evaluate/Discuss questions: 6-mark scenario questions comparing technical vs non-technical security strategies in an organisation.