Phishing and Social Engineering

🔥 Opening Hook

In 2020 a Twitter employee received
a phone call.

The caller claimed to be from
Twitter’s internal IT department.

They asked the employee to help
with a routine system issue.

The employee — trying to be helpful —
provided the access they asked for.

Within hours the attackers had
taken over the Twitter accounts of
some of the world’s most prominent
people — Barack Obama, Elon Musk,
Apple, and dozens of others —
and used them to run a
cryptocurrency scam.

The breach was not caused by
a technical vulnerability.

It was caused by a phone call
and a helpful employee.

That is social engineering.
And it works on everyone —
including highly trained professionals
at major technology companies.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. What Is Phishing?

The Phishing Cycle consist of:

Trust → Urgency → Action → Compromise

Phishing is a type of cyberattack
where criminals send deceptive
communications — typically emails,
SMS messages, or instant messages —
designed to trick recipients into:

→ Revealing sensitive information
such as passwords, PINs,
or banking details
→ Clicking malicious links that
install malware or redirect
to fake websites
→ Transferring money or providing
financial access
→ Granting access to systems
or accounts

The name comes from fishing —
attackers cast a wide net,
knowing that even a small
percentage of responses
makes the effort worthwhile.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2. Types of Phishing Attacks

2.1 Mass Phishing

The most common form —
millions of identical messages
sent to random recipients
impersonating trusted brands.

Common impersonations:
→ Banks — “Your account has
been suspended. Verify now.”
→ Delivery companies —
“Your package could not
be delivered. Click to reschedule.”
→ Government agencies —
“Your tax refund is ready.
Claim it here.”
→ Technology companies —
“Your account security
has been compromised.”
→ Mobile money providers —
particularly common across
Africa where mobile money
adoption is high

2.2 Spear Phishing

A targeted attack aimed at
a specific individual —
using personal information
gathered from social media,
LinkedIn, or previous data breaches
to make the message more convincing.

Example:
An attacker researches a finance
officer on LinkedIn. They know
their name, their company, their
manager’s name, and recent
company news. They send an email
appearing to be from the manager
with a specific, plausible request.

The personalisation makes it
dramatically more convincing
than a generic phishing attempt.

2.3 Whaling

Spear phishing targeting
senior executives — CEOs,
CFOs, and board members.

These attacks are highly
researched and often involve
requests for large financial
transfers or access to
sensitive corporate systems.

2.4 Smishing and Vishing

Smishing:
Phishing via SMS —
text messages with malicious
links or requests for information.

Vishing:
Phishing via voice call —
as in the Twitter attack above.
Attackers call pretending to be
from banks, IT departments,
government agencies, or
trusted organisations.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3. How to Recognise a
   Phishing Attempt

The most important skill in
cybersecurity is the ability
to pause and examine before acting.

Red flags in email phishing:

Sender address:
→ The display name looks correct
but the actual email address
is suspicious —
support@paypa1.com instead of
support@paypal.com
→ A domain that is slightly wrong —
one letter changed, a hyphen added,
or a different extension used

Urgency and pressure:
→ “Your account will be closed
in 24 hours”
→ “Immediate action required”
→ “Respond before end of business today”

Urgency is one of the most
reliable red flags in any
suspicious communication.
Legitimate organisations rarely
create panic — attackers always do.

Unexpected requests:
→ A bank asking you to confirm
your full password or PIN
→ A colleague asking for payment
details via email
→ A request to bypass normal
approval processes

Links and attachments:
→ Hover over links before clicking —
the actual destination often
reveals the deception
→ Unexpected attachments —
particularly ZIP files,
executable files, or documents
asking you to enable macros
→ Shortened URLs that hide
the true destination

Grammar and presentation:
→ Spelling mistakes and poor grammar —
though sophisticated attacks
are increasingly well-written
→ Generic greetings —
“Dear Customer” from your bank
→ Formatting that looks slightly
different from genuine communications

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

4. What Is Social Engineering?

Social engineering is a broader
category of attack that exploits
human psychology rather than
technical vulnerabilities.

Phishing is one form of
social engineering — but
social engineers use many tactics:

4.1 Pretexting

Creating a fabricated scenario
to extract information or access.

Example:
An attacker calls an employee
pretending to be an auditor
who urgently needs access to
financial records before a
regulatory deadline.

4.2 Baiting

Offering something enticing —
a free download, a prize,
or a USB drive left in a
car park — that contains
malicious content.

The curiosity or greed that
drives someone to plug in
an unknown USB drive or
download a free software
cracker is what the
attacker is exploiting.

4.3 Quid Pro Quo

Offering a service in exchange
for information or access.

Example:
“I am from IT support —
I can fix your computer
slowness if you just give
me your login credentials.”

4.4 Tailgating and Impersonation

Physical social engineering —
following an authorised person
through a secure door, or
impersonating a delivery driver,
maintenance worker, or colleague
to gain physical access.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

5. Why Social Engineering Works

Social engineers exploit
normal, healthy human instincts:

→ Helpfulness — we want to
assist people who need help
→ Trust — we extend good faith
to people who seem legitimate
→ Authority — we comply with
requests from apparent superiors
→ Urgency — we act quickly
when something seems time-sensitive
→ Fear — we respond to threats
about our accounts, jobs,
or security
→ Curiosity — we want to know
what is in that email,
on that drive, behind that link

None of these instincts are flaws.
They are what make us good
colleagues, good professionals,
and good people.

Attackers have simply learned
to exploit them deliberately.

The defence is not to become
suspicious of everyone —
it is to develop the habit of
pausing before acting on
unexpected requests.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

6. What to Do When You
   Suspect Phishing

If you receive a suspicious
communication — do not panic.

Do this instead:

→ Do not click any links or
open any attachments
→ Do not reply to the message
→ Verify independently —
if the message claims to be
from your bank, go directly
to the bank’s official website
by typing it in your browser,
or call the official number
→ Report it to your IT or
security team if at work
→ Report it to your national
cybercrime authority if personal

The key principle:
When in doubt — verify
through a separate, independent
channel before taking any action.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🌍 Global and African Context

Phishing attacks impersonating
mobile money providers, banks,
and telecommunications companies
are among the most common
cyber threats facing individuals
across Africa.

The growth of mobile-first
digital services — while enormously
beneficial — has created a large
population of users who are
new to digital financial services
and therefore more vulnerable
to social engineering.

Globally — business email
compromise, where attackers
impersonate senior executives
or trusted suppliers to
authorise fraudulent payments,
costs organisations billions
of dollars every year across
every continent.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚡ Power Insight

The most dangerous phishing
attacks do not look like
phishing attacks. They look
like legitimate, urgent,
personalised communications
from people you trust. The
defence is not suspicion —
it is the habit of pausing,
questioning, and verifying
independently before taking
any action on any unexpected
request. That habit, applied
consistently, stops the
majority of attacks cold.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

✍️ Quick Action Challenge

⚡ Takes 5 minutes:

Find a recent email in your inbox
from a company or organisation —
a bank, a delivery service,
a platform you use.

Now examine it as if you were
a security professional:
→ Is the sender address exactly right?
→ Does the link destination match
the company’s official domain?
→ Is there any urgency or
pressure in the message?
→ Does anything feel slightly off?

This is not about finding
something wrong — most emails
are legitimate.

It is about building the habit
of looking before you act.

🚀 Want to go deeper?
Google has a free phishing
quiz at phishingquiz.withgoogle.com
— it takes about 10 minutes
and tests your ability to spot
real phishing attempts.
It is surprisingly challenging
even for experienced professionals.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📚 Sources & Further Reading

• Google —
  Phishing Quiz
  phishingquiz.withgoogle.com
• Anti-Phishing Working Group —
  Phishing Activity Trends Report
  (updated regularly)
  apwg.org/resources/apwg-reports
• Cybersecurity and Infrastructure
  Security Agency (CISA) —
  Phishing Guidance
  cisa.gov/phishing
• INTERPOL —
  Business Email Compromise
  interpol.int/en/Crimes/
  Financial-crime/
  Business-Email-Compromise
• KnowBe4 —
  Security Awareness Resources
  knowbe4.com/resources

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📌 Key Takeaway

Phishing and social engineering
succeed because they exploit
human nature — not technical
weaknesses. The Twitter hack,
the fraudulent wire transfer,
the stolen mobile money account —
all began with a message, a call,
or a click. The professionals
who resist these attacks are
not more suspicious than others —
they are simply more deliberate.
They pause. They verify.
They never let urgency override
judgment. Build that habit
and you will stop the majority
of attacks before they start.