LockInCS

Topic 1.1 · Unit 1: Introduction to Security · 15 minute session

1.1 Understanding Social Engineering

Social engineering attacks manipulate people instead of computers. Adversaries use psychological tactics such as intimidation and urgency to get a target to reveal sensitive information, download a malicious file or click a malicious link, and the victim can lose personal information, one-time codes or login credentials.

Big idea Social engineering attacks the person, not the computer.

Course and exam description (CED) codes covered: 1.1.A.11.1.A.21.1.B.11.1.B.21.1.B.31.1.C.11.1.C.21.1.C.3

Last reviewed against the CED:

By the end of this session you can

  • 1.1.A Identify common indicators of social engineering tactics.
  • 1.1.B Explain how social engineering tactics influence victims to perform a desired action.
  • 1.1.C Describe possible impacts for victims of social engineering attacks.

Already know this? Jump to the checkpoint.

1. What social engineering looks like (1.1.A)

Many attacks start with a person, not a computer. Social engineering uses psychological tactics to manipulate someone into doing one of three things 1.1.A.1:

The adversary wants you to Example
Reveal sensitive information (called elicitation) “Confirm your date of birth so we can verify you.”
Download a malicious file “Your invoice is attached: invoice.zip”
Click a malicious link “Track your parcel here.”

It can happen face to face, but it usually arrives by email, text message or social media message 1.1.A.1.

Two tactics show up again and again 1.1.A.2:

  • Intimidation: the adversary threatens negative consequences if you do not comply. “Your account will be suspended.”
  • Urgency: the adversary gives you a reason to act quickly. “Reply within 10 minutes.”
A made-up phishing email with five numbered red flags: a look-alike sender address using the digit 1 instead of the letter l, an urgent two-hour deadline, a threat that the account will be permanently deleted, a button hiding a fake link, and a request for the password and the six-digit code.
Anatomy of a phishing message: five red flags. Real messages often show only two or three.

2. Why the tactics work (1.1.B)

These tactics work because they use ordinary psychology that influences everyone 1.1.B.1.

  • Intimidation taps into our natural dislike of bad outcomes. Pointing at a possible loss creates fear, and fear pushes people to act 1.1.B.2.
  • Urgency taps into our habit of reacting fast to time-sensitive needs. Under pressure we skip the pause where we would ask, “Is this reasonable? Is this safe?” 1.1.B.3

Detect: when a message makes you feel scared or rushed, treat that feeling as a red flag and slow down. Check through a channel you already trust, such as the official app, instead of the link in the message.

3. What victims can lose (1.1.C)

What the victim gives away What the adversary can do with it
Personal information: name, phone number, address, workplace, pets’ names, birthdate 1.1.C.1 Impersonate the victim. Details like these are often the answers to website challenge questions.
A one-time password (OTP) or login code 1.1.C.2 Log in to the service as the victim.
A download or a click 1.1.C.3 Install malware, steal data saved in the web browser, or send the victim to a fake login page that captures their credentials.

Try it below on a real-looking email, then on a text message. Some parts are red flags and some are normal.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

  • IntimidationFear makes you obey: "Do this or something bad happens."
  • UrgencyA clock makes you skip the check: "Do this in the next 15 minutes."
  • The three asksTell, download, click: every social engineering message wants you to reveal something, download something or click something.

Common misconceptions

  • "Social engineering only happens by email."

    Not quite. It also happens in person, by text message and through social media messages. The channel changes; the psychological tactics stay the same.

  • "Only careless people fall for it."

    Not quite. The tactics work on normal human reactions: we avoid bad outcomes and we react fast to deadlines. That is why everyone needs to slow down and check.

  • "Sharing a one-time code is safe because it expires quickly."

    Not quite. A few minutes is all an adversary needs. Anyone holding a valid one-time password (OTP) can log in as you while it lasts.

Simulation · [1.1.A.1, 1.1.A.2, 1.1.B.2, 1.1.C.2, 1.1.C.3]

Inspect the email: find the five red flags

You are helping a teacher clear their inbox when this arrives. Before anyone clicks, tap every part that is a red flag.

School Mail

  1. Red flag. Look-alike sender: the school's real domain is school.edu (look at your own address). school-scholarships.net is a different domain made to look official.

  2. Fine. Your own address. Nothing suspicious here.

  3. Red flag. Urgency: "expires at 5 PM today" pushes you to act before you check whether it is safe.

  1. Fine. Real award emails say this too, which is why adversaries copy it. Judge what the message asks you to do.

  2. Red flag. Intimidation: losing the award and being marked ineligible uses fear of a negative consequence.

  3. Fine. A button on its own is normal. What matters is where it goes: check the link preview below it.

  4. Red flag. Malicious link: the button hides a fake address that captures your login credentials.

  5. Red flag. Elicitation: asking for the password and one-time code lets the adversary log in as you.

  6. Fine. A normal sign-off. Anyone can type it.

Simulation · [1.1.A.1, 1.1.A.2, 1.1.C.2, 1.1.C.3]

Clue hunt: is this text message a social engineering attack?

A text arrives on a student’s phone. Tap every line that is a red flag, then check your answers.

7:42
+1 (555) 014-2207Text message · Today

  1. Fine. A greeting on its own proves nothing either way. Anyone can claim to be support.

  2. Fine. Real services do send alerts like this, which is exactly why adversaries copy them. Judge the request, not the opener.

  3. Red flag. Urgency and intimidation together: a short deadline plus a threat of losing the account, so you act before thinking.

  4. Red flag. No real service asks you to send back a one-time password (OTP). Whoever has that code can log in as you.

  5. Red flag. A look-alike link to a login page: the classic way to capture credentials.

  6. Fine. Friendly closing lines are normal in real and fake messages alike.

Exam traps

  • Match the impact to what the message asks for. A request for a pet's name and birthdate leads to impersonation, not malware.

By the numbers

Say each list out loud, then tap to check.

3 actions Say them, then tap
  • reveal sensitive information (elicitation)
  • download a malicious file
  • click a malicious link
2 tactics Say them, then tap
3 impacts Say them, then tap
personal details
  • impersonation
one-time password or login code
  • log in as the victim
click or download
  • malware
  • browser data theft
  • captured credentials

In 30 seconds

  1. Social engineering manipulates people into revealing information (elicitation), downloading a malicious file or clicking a malicious link.
  2. It happens in person, by email, by text and through social media messages.
  3. Intimidation uses fear of negative consequences. Urgency uses time pressure so you skip the safety check.
  4. Victims can lose personal details used in challenge questions, one-time codes that let an adversary log in, or credentials and data through malware or fake login pages.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Checkpoint · 6 questions

Checkpoint: Understanding Social Engineering

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. 1 Which of these is NOT one of the three things a social engineering attack usually tries to get a target to do? 1.1.A.1
    Show answer

    Answer: A. Social engineering aims to get the target to reveal information (elicitation), download a malicious file or click a malicious link. Updating software is a defense, not the goal of an attack.

  2. 2 "Pay the fee today or your phone line will be cut off and reported." Which two tactics does this message combine? 1.1.A.2
    Show answer

    Answer: C. "Today" creates urgency, a reason to act quickly. "Cut off and reported" is intimidation, a threat of negative consequences.

  3. 3 Why does urgency make people more likely to fall for an attack? 1.1.B.3
    Show answer

    Answer: C. Urgency uses our habit of reacting fast to time-sensitive needs, which skips the pause where we would question whether an action is safe.

  4. 4 Intimidation works because it leverages which natural human tendency? 1.1.B.2
    Show answer

    Answer: B. Intimidation draws attention to possible negative consequences, using fear to push the target to act.

  5. 5 A quiz on social media asks for your first pet's name and the street you grew up on. Why could answering be risky? 1.1.C.1
    Show answer

    Answer: D. Personal details like pet names and addresses are common challenge questions used to verify identity, so they help an adversary impersonate you.

  6. 6 Someone posing as support convinces a student to read out the 6-digit code just sent to their phone. What can the adversary most likely do next? 1.1.C.2
    Show answer

    Answer: B. A one-time password (OTP) or login code lets whoever holds it log in as the victim while it is valid.

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

  • Social engineeringtap to flip

    An attack that uses psychological tactics to manipulate people into revealing sensitive information, downloading a malicious file or clicking a malicious link.

    Example and CED codes
  • Elicitationtap to flip

    Getting a target to reveal sensitive information through conversation or messages, a goal of social engineering.

    Example and CED codes
  • Intimidationtap to flip

    A social engineering tactic where the adversary threatens negative consequences if the target does not comply.

    Example and CED codes
  • Urgencytap to flip

    A social engineering tactic where the adversary creates a reason or deadline for the target to act quickly.

    Example and CED codes
  • One-time password (OTP)tap to flip

    A code that works for a single login or a short time, often sent by text or an authenticator app as a second factor.

    Example and CED codes
  • Malwaretap to flip

    Software designed to harm a device or its user, such as by stealing data, spying or giving an adversary control.

    Example and CED codes
  • Credential harvestingtap to flip

    Collecting real usernames and passwords through a fake login site.

    Example and CED codes

Questions students ask

What is social engineering in AP® Cybersecurity?

Social engineering is an attack that uses psychological tactics to manipulate a person into revealing sensitive information, downloading a malicious file or clicking a malicious link.

What is the difference between intimidation and urgency?

Intimidation threatens the target with negative consequences if they do not comply. Urgency creates a reason to act quickly. Many attacks use both, such as a threat that an account will be deleted within minutes.

Why do adversaries want pet names and birthdates?

Websites often use details like these as challenge questions to verify identity, so an adversary who collects them can impersonate the victim.

↑ Top

Enlarged view of the selected figure