Social Engineering
Phishing
Phishing is a social engineering technique in which a message pretending to come from an organisation you trust — an email, a text message or a phone call — is used to get personal information from you, or to send you to a fake website that collects it.
How a phishing message makes itself believable
Two details make these messages convincing:
- Forged sender address — the sender address is faked so it matches one the real organisation uses, so the message appears to come from a genuine account.
- Fake login page — the message contains a link to a page copied from the real login screen. Anything you type there goes to the attacker instead of the organisation.
For example, an email seems to come from your school's IT support team, saying your account must be confirmed before a system upgrade. The link opens a page that looks just like the school login, and typing your username and password there sends them to whoever sent the email.
Spear phishing and vishing
| Technique | What it means | Why it works |
|---|---|---|
| Spear phishing | Phishing aimed at one particular person or organisation | It uses personal details about the target, so the sender seems to know them and the message looks genuine |
| Vishing | Phishing carried out by voice, using a telephone call or voice message | A voice can answer your questions on the spot and pressure you into acting quickly, which a written message cannot |
A spear phishing message might name your form tutor and a trip you have really booked, asking you to check a payment page — the personal details make it much harder to doubt. A vishing call might claim to be from the shop where you ordered a games console, saying the payment failed, and press you to read your card details out over the phone.
The two can overlap: a call aimed at one person, using details about them, is both vishing and spear phishing.
Practise this
Edexcel GCSE Computer Science · Social Engineering