Phishing and Social Engineering

By the end

What you'll build

• Inspect a suspicious message and name the specific signals that make it suspicious
• Verify an unexpected request for money, credentials or data through an independent channel before acting
• Recognise social engineering delivered by phone, text, chat, calendar invite, QR code or in person
• Report a suspected attempt through the internal route without deleting or forwarding the evidence
• Take the correct first steps in the minutes after you have clicked, replied or entered credentials

Curriculum

What's inside

6 modules · 35 lessons

1. 01

   How Social Engineering Works On People

   5 lessons
   • Authority, Urgency and Fear: The Levers Behind Almost Every Attack
   • Pretexting: The Story That Makes the Ask Sound Reasonable
   • Why Busy, Competent People Fall For It
   • Reconnaissance: What an Attacker Learns About You First
   • Levers, pretexts and conditions: match what you saw to what it wasmatch pairs
2. 02

   Reading a Suspicious Message

   6 lessons
   • A Ten-Point Inspection You Can Run in Thirty Seconds
   • Sender Names, Display Names and Look-Alike Domains
   • Links: Hovering, Shorteners and Chained Redirects
   • Attachments and the File Types That Should Make You Pause
   • Requests That Quietly Bypass an Existing Process
   • + 1 more lesson
3. 03

   Beyond the Inbox

   7 lessons
   • Voice, Text and Chat: Social Engineering Off Email
   • Phone Pretexting and Spoofed Caller Identity
   • Messaging App Lures and Fake Recruitment Approaches
   • Calendar Invites, File-Share Notices and Collaboration Requests
   • QR Codes, Posters and Dropped Media
   • + 2 more lessons
4. 04

   Targeted and Financial Attacks

   6 lessons
   • When the Request Appears to Come From Your Own Side
   • Spear Phishing Assembled From Public Information
   • Invoice Fraud and Bank Detail Changes
   • Supplier and Partner Account Takeover
   • Out-of-Band Verification That Actually Works
   • + 1 more lesson
5. 05

   Reporting and Recovery

   6 lessons
   • You Clicked: The First Ten Minutes
   • Reporting Without Forwarding the Attack Onward
   • What Not to Delete, and Why
   • Simulated Phishing Exercises: What They Are and Are Not For
   • Helping a Colleague Who Has Been Caught
   • + 1 more lesson
6. 06

   Practice and check

   5 lessons
   • Tactic, Tell and Meaningmatch pairs
   • The First Ten Minutes After You Clicksequence order
   • Say It Preciselyfill blank
   • The Invoice That Changed Its Bank Detailsscenario
   • Course quizquiz

The shape of it

How this course works