Phishing & Social Engineering
The most dangerous cyberattacks don't involve complex code or movie-style hacking. They exploit something far more vulnerable: human psychology. If you can learn to spot a phishing attempt, you'll be safer online than 90% of adults.
1. The Human Exploit
Imagine a castle. A cyber-hacker could spend all day trying to break down the giant wooden door (the computer's code). Or... they could just trick a guard into handing over the key! Social engineering is tricking people to get the key. It's usually easier than breaking down the door.
Which of these is the "key" hackers want most?
So, what do these tricks look like?
Phishing
A fake email or message that pretends to be from a trusted source — your bank, Netflix, Amazon, Google. Designed to steal passwords and credit cards.
Spear Phishing
A targeted phishing attack on a specific person. The attacker researches you first (social media, LinkedIn) and personalizes the message. Much harder to detect.
Vishing
Voice phishing — a phone call from someone pretending to be tech support, your bank, or even a government agency. "We detected unusual activity on your account…"
Smishing
SMS phishing — fake text messages claiming to be from delivery companies, banks, or services. "Your package couldn't be delivered. Click here to reschedule."
2. Spot the Phish (Shapeshifters in Disguise)
Look at each email carefully. Is it real or a phishing attempt? Click your verdict after reading — then see the explanation!
Dear PayPal Customer,
We have detected unusual activity on your account. To avoid permanent suspension, you must verify your identity within 24 hours.
Please click the link below to restore your account:
http://paypal-account-verify.secure-login.net/restore
PayPal Security Team · © 2024 PayPal Inc.
A new sign-in on Windows
Your Google Account ([email protected]) was just signed in to from a Windows device. If this was you, you don't need to do anything.
Review your account activity
You received this email to let you know about important changes to your Google Account and services.
Google LLC · 1600 Amphitheatre Pkwy · Mountain View, CA 94043
Hello,
We attempted to deliver your recent Amazon order but were unable to complete the delivery. A $1.99 redelivery fee is required to release your package.
Please update your delivery information and payment details here:
https://amazon-redelivery.com/update?order=7723
Amazon Logistics · Delivery Services
🕵️ Evidence Hunt: Spot the Clues!
Let's turn this into a game! Every phishing attempt leaves clues. Click on the red flags in the fake PayPal email below to collect evidence.
Please click the link below to restore your account:
http://paypal-account-verify.secure-login.net/restore
🚀 Pro Move: Hackers can fake the 'From' name. A real pro checks the email headers. This is like the digital postmark on an envelope, showing the true path the email took. In most email apps, look for an option like 'Show Original' or 'View Source' to see them.
Challenge: Build a (Harmless) Phish
The best way to spot a trick is to learn how it's made. Let's think like a hacker. Choose the most effective options to build your own phishing email.
4. How to Read a URL
The URL (web address) is where attackers hide most cleverly. The trick is knowing which part to read.
The Rule: The real domain is the part just before the first slash (`/`).
Subdomains: Friend or Foe?
Sometimes safe sites use subdomains for different sections. The real domain is still the part at the end.
🚀 Advanced Challenge: Use a Real Scanner
Cybersecurity pros use tools to verify links. Let's try one!
- Copy a fake URL from our examples (like
http://paypal-account-verify.secure-login.net) and paste it into a URL scanner like VirusTotal. See what real security engines say! - Experiment: Now, let's see how hackers hide links. Go to a URL shortener like bitly.com (with a parent's permission), paste in a *safe* URL like
https://www.google.com, and create a short link. Now, paste your new `bit.ly` link into VirusTotal. See how it follows the link and shows you the *final destination*? This is how security tools unmask tricky links!
5. Sneaky Brain Tricks
Phishing works because it's designed to hack our brains, not just our computers. Let's see if you can spot the trick.
Scenario 1: You get a pop-up saying 'VIRUS DETECTED!' while playing a game. What brain trick is the hacker using?
Scenario 2: A message from your 'principal' asks for your password to a new school portal. What brain trick is this?
If an email, text, or message feels weird, urgent, or too good to be true, stop and take a 5-second pause. Ask yourself: "Did I expect this?" If not, ask a parent or trusted adult before you click ANYTHING. It's not about getting in trouble; it's about having a teammate to help you spot the trick!
🕵️ Security Clearance Quiz
Prove you can think like a cybersecurity analyst!
👨👩👧 Parent Corner: From Learning to Doing
Great job working through this! Now is the perfect time to level up your family's security together. Here are two activities:
- The "Go Direct" Rule: Make a family rule that for any urgent email from a bank, store, or service, you NEVER click the link. Instead, you always open a new tab and type the website address in yourselves.
- Family Password Power-Up Night: This is a great time to introduce a password manager. Tools like Bitwarden have family plans and can protect you from phishing by only auto-filling passwords on the *real* website. Spend 15 minutes together setting one up and updating a few important passwords!