Phishing and social engineering

Social engineering is tricking a person instead of a computer. It works because people are helpful, busy and trusting. Phishing is the email version: a message pretending to be someone you trust, to get you to click a link, open an attachment, type a password or send money. Smishing is the text message version and vishing the phone call.

Most phishing is sent to thousands of people at once. Spear phishing is aimed at one person, using details about them from social media or the company website. Business email compromise (BEC) pretends to be a boss or a supplier and asks for a payment or a change of bank details. It needs no malware at all, and it's one of the costliest kinds of fraud.

The red flags: urgency or fear ("your account closes today"), a request that skips the usual process ("pay this now, don't tell anyone"), a sender address that doesn't match the name, a link whose real address isn't the company's, an unexpected attachment, and a greeting that doesn't use your name. One flag isn't proof; two or three is a reason to stop.

Check where a link really goes. Find the domain: the part after https:// and before the next /. Then read it from the right, because the end says whose site it is. In https://pondbank.com.account-check.example/login the domain ends account-check.example, so that's whose site it is; pondbank.com is just a label in front. On a computer, hover over a link to see where it really goes before clicking.

When in doubt, check another way. Don't use the phone number or link in the message: open the app yourself, type the address you know, or call the number on the back of your card or in the staff directory. A real request survives a check; a scam doesn't.

If you clicked or typed a password, say so straight away. Change the password, tell your IT or security team, and use the Report Phishing button if your email has one. Quick reports stop the same email from catching colleagues, and nobody good at security blames people for reporting.