Social engineering

Hacking the human

• The weakest part of any system is often people, not computers.
• Social engineering means tricking a person into giving away secrets or access. No malware needed.

Phishing and pharming

• Phishing — a fake email or message that looks real, asking you to "log in" on a fake site that steals your password.
• Pharming — redirecting you to a fake website even when you typed the correct address.
• Both aim to steal your login details by pretending to be a site you trust.

Spotting a phishing message

• Check the sender's address and the link — hover to see where it really goes.
• Watch for urgency ("act now or your account closes!") and spelling mistakes.
• A real bank will never ask for your password by email.

Other tricks

• Shoulder surfing — simply watching you type your PIN.
• Baiting — leaving an infected USB stick for a curious person to plug in.
• The defence is awareness: slow down and check before you click or type.

Covers: IGCSE 5.3 (phishing, pharming, social engineering), AP CSP Big Idea 5.

Now you try

• First build a tiny phishing filter: check the sender's address and where the link really points.
• Then match three more tricks to their names — exactly what the exam asks you to do.

Common mistakes

• The weakest link is often people, not software.
• Phishing tricks you into giving up secrets — check the sender and the link first.