Royal Army College

Lesson Overview

Lesson 02 made your accounts hard to break into with strong passphrases and multi-factor authentication. This lesson deals with the way most attackers get in anyway, not by breaking the lock but by persuading the person holding the key to open the door. That persuasion is called social engineering, and its most common form is phishing: a message that pretends to come from someone you trust, so that you click a link, hand over a password, open a file, or do something you would never knowingly do for a stranger. It is the single most common way real organisations are breached, and it works on careful, intelligent people, because it does not attack the computer; it attacks human instincts to be helpful, to obey authority, and to act quickly under pressure.

This lesson teaches you to recognise that pressure and to defeat it with a steady method. It explains the family of attacks, phishing by email, smishing by text, vishing by voice, and pretexting, the invented story that carries them. It sets out the psychological lures the attacker reaches for: urgency, authority, fear, secrecy, and reward. It then gives you a checking routine you can run on any unexpected message in under a minute, and a simple stop, check, report flow to fall back on when something feels wrong. It explains how to report a suspected phishing attempt, and, just as importantly, what to do if you have already clicked or given something away. The whole lesson rests on one idea: you are not the weak link in the Principality's security. Trained and alert, you are its first line of defence, the human firewall that no software can replace.

This is the knowledge layer. Reading it builds the recognition; the habit is built by doing. The practical side, examining a real suspect message safely, running a reporting drill, and rehearsing the steps to take after a wrong click, is done and signed off in person where supervision allows. By the end you will be able to define social engineering and phishing and name its forms across email, text, and voice, explain pretexting and the lures of urgency, authority, fear, secrecy, and reward, run a checking routine on any unexpected message, apply a stop, check, report decision flow under pressure, report a suspected phishing attempt correctly, and respond honestly and at once if you have already clicked or disclosed something, because reporting fast is the act that limits the harm.

Key Terms

Social engineering: the manipulation of a person, rather than a computer, into doing something that weakens security, such as revealing a password, clicking a malicious link, or making a payment. It works on trust and emotion, not on technical flaws.
Phishing: a fraudulent message, usually email, that impersonates a trusted sender to trick the recipient into clicking a link, opening an attachment, or giving up information or credentials.
Smishing: phishing carried out by text message (SMS) or chat, often a short message with a link and a sense of urgency.
Vishing: phishing carried out by voice, a phone call in which the caller impersonates someone trusted, such as support staff, a bank, or a senior person, to extract information or action.
Pretext: the false but believable story an attacker invents to make contact seem legitimate, for example posing as IT support, a delivery service, a colleague locked out of an account, or a senior officer with an urgent request.
Credential harvesting: tricking a person into typing a username and password into a fake login page that looks like the real one, so the attacker captures the credentials.
Spear phishing: a phishing attempt aimed at a specific person or small group, using real details about them to seem convincing, as opposed to mass phishing sent blindly to many.
Business email compromise (BEC): a targeted attack in which an attacker impersonates a senior or trusted figure, often to push through an urgent payment or the release of information, usually with no link at all, just a persuasive request.
The human firewall: the idea that an alert, trained person is a layer of security in their own right, catching attacks that slip past technical defences.

What social engineering is, and why it works

Most people picture an attacker as a technician hammering at a system from the outside, defeating encryption by sheer skill. Real attacks are rarely like that. It is far easier, and far more reliable, to get a person to open the door from the inside. Social engineering is the craft of persuading that person. The attacker does not need to break your password if you can be talked into typing it onto a fake page, and does not need to defeat your locked device if you can be persuaded to install something yourself. The target is never really the machine. It is you.

It works because it turns your good qualities against you. We are trained from childhood to be helpful, to respect authority, and to act promptly when something seems urgent. An honest organisation relies on these instincts every day, and the social engineer borrows them. A message that looks like it comes from your own IT team, asking you to confirm your password before your account is locked, leans on your wish to cooperate and your fear of being shut out. None of this requires you to be foolish. It requires only that you be human and busy, which everyone is. That is why the answer is not to feel clever, but to keep a habit, a routine you run regardless of how the message makes you feel.

For a non-territorial Principality, the stakes are sharp. The state lives in its systems: the single sign-on that holds accounts, the records of nationals, the per-user certificates and keys that let members reach secure services. An attacker who phishes one set of credentials may reach far more than one inbox. This is precisely why the alert member matters so much. The lock on the door is only as good as the person deciding whether to open it.

The family of attacks

Phishing is the best known member of a family, all built on the same trick of a trusted disguise. Knowing the whole family means you are not caught out when the attack arrives by a channel you were not watching.

Phishing (email). The classic form. An email appears to come from a trusted source, a service you use, a colleague, a senior person, your own IT team, and asks you to do something: click a link to "verify" or "reactivate" an account, open an attached invoice or document, confirm details, or reply with information. Mass phishing is sent blindly to thousands; spear phishing is crafted for you, using real names and details to seem genuine.

Smishing (text). The same trick by SMS or chat message. Because texts are short, the attacker strips it to the essentials: a brief alarm ("a parcel could not be delivered", "unusual sign-in detected", "your account is suspended") and a single link. People tend to trust their phones and read texts quickly, which is exactly why this works.

Vishing (voice). A phone call. The caller plays a part, support staff fixing an "urgent problem", a bank's fraud line, a delivery firm, sometimes a senior figure, and uses the live conversation to apply pressure and steer you, asking you to read out a code, confirm a password, install remote-access software, or make a payment. The voice and the back-and-forth make it feel more real than an email, which is its strength and your warning sign.

Pretexting. Not a separate channel but the engine inside the others: the invented but believable story that makes contact seem legitimate. The IT technician who needs your password "to apply a fix", the colleague locked out who needs you to forward a code, the delivery agent who needs a small payment to release a parcel, the senior officer too busy to discuss it who simply needs the thing done now. The better the pretext fits a situation you might really be in, the more dangerous it is.

A particularly costly relative is business email compromise: a targeted impersonation of a senior or trusted person, pushing an urgent payment or the release of sensitive information. It often carries no malicious link at all, only a persuasive request, which is why no checklist that looks only for bad links will catch it. The defence against all of these is the same, and it is the subject of the rest of this lesson.

The lures: what the attacker reaches for

Whatever the channel, social engineering pulls on a small set of emotional levers. Learn to feel them being pulled. The moment a message makes you feel one of these strongly is the moment to slow down, not speed up.

Urgency. "Act now or your account will be closed in two hours." Urgency exists to stop you thinking. A real organisation rarely gives you minutes to comply, and almost never punishes you for taking the time to check. Manufactured urgency is the single commonest signature of an attack.

Authority. A message that appears to come from someone senior, or from an official body, or from "IT", trades on your reluctance to question authority. The attacker counts on you doing as you are told rather than verifying who is telling you. Genuine authority does not mind being checked; only an impostor needs you not to.

Fear. "Suspicious activity has been detected on your account." "You are in breach of policy." Fear, like urgency, narrows your thinking to escaping the threat. The fix it offers, click here, confirm now, is the trap.

Secrecy. "Keep this between us." "Do not discuss this with anyone yet." A request for secrecy is a serious warning sign, because secrecy is exactly what stops you from doing the one thing that defeats the attack: checking with someone else. Honest urgent business survives being verified; a scam depends on it not being.

Reward. "You have a refund waiting." "You have been selected." A prize, a refund, an unexpected payment, anything that makes you want to act before the chance disappears. Greed and curiosity are levers as much as fear is.

Notice that none of these levers is about technology. They are about you. This is the heart of the lesson: the defence is not chiefly technical knowledge but emotional discipline. When a message makes you feel hurried, frightened, flattered, or sworn to secrecy, treat the feeling itself as the alarm.

How to check a message

Here is the routine. Run it on any unexpected message that asks you to click, open, pay, or tell. It takes under a minute and it is the same whether the message arrived by email, text, or call. Do not run only the steps that seem to apply; run the habit.

Were you expecting it? An unexpected message asking for action is the starting suspicion. Most attacks land out of the blue. A message you did not ask for, did not anticipate, and that wants something from you, deserves the full check.

Who is it really from? Look at the actual sender, not the display name. Display names are trivially faked; an email from "Kaharagia IT Support" may sit behind an address that has nothing to do with the Principality. On a phone, a number can be spoofed too, so a familiar-looking caller ID proves nothing. Check the real address or domain, and be wary of look-alikes, small misspellings, swapped letters, or an extra word in the domain.

Where does the link really go? Before you click anything, hover over the link (on a computer) or press and hold it (on a phone) to reveal the true destination, and read it from the right. The important part of a web address is the registered domain just before the first single slash, not the words at the start. A link reading "yourbank-secure-login.example.com" does not go to your bank; it goes to "example.com". When in doubt, do not click the link at all; go to the service yourself by typing the address you know or using a saved bookmark.

Never enter credentials from a link in an unexpected message. This is the rule that defeats credential harvesting outright. A login page reached by clicking a link in a message you did not expect should never receive your password, even if it looks perfect. If you genuinely need to sign in, leave the message, open the site the way you normally do, and sign in there.

Treat unexpected attachments as dangerous. An attachment you were not expecting, an invoice, a "document to review", a parcel notice, can carry malware. Do not open it to find out what it is. If it claims to be from someone you know, that is precisely the case to verify before opening.

Verify on a separate, known channel. This is the master move and it beats almost everything, including business email compromise that carries no link at all. If a message asks for anything that matters, a payment, a password, a code, sensitive information, confirm it through a different channel you already trust: ring the person back on a number you already have (not one the message gave you), message them on the established system, or ask them in person. If a senior officer "emails" an urgent unusual request, a thirty-second check on a known channel costs nothing and ends the attack.

These steps are little individually and decisive together. Most attacks fail the very first one, "were you expecting it", and almost all fail "verify on a separate channel". Modern phishing often looks flawless, so the routine does not ask whether the message looks real; it checks whether it is real, by going around the message to the truth behind it.

Here is an annotated example. Read the message, then read the flags marked beside it.

  ------------------------------------------------------------------------
  From:  "Kaharagia IT Support" <it-support@kaharag1a-secure.help>   (1)
  To:    you
  Subject:  URGENT: Your account will be suspended today              (2)
  ------------------------------------------------------------------------

   Dear User,                                                         (3)

   We have detected suspicious sign-in activity on your account.      (4)
   To avoid suspension, you must verify your password within
   2 hours, or access will be permanently revoked.                   (2)

   >>  Verify my account now  <<                                      (5)
       (link points to: kaharag1a-secure.help/login)

   Please do not share this email with colleagues while the           (6)
   security review is in progress.

   Regards,
   The IT Security Team

  ------------------------------------------------------------------------
   RED FLAGS
   (1) Sender domain is a look-alike: "kaharag1a-secure.help" is NOT a
       real Principality domain. The display name is faked; read the
       address.
   (2) Manufactured URGENCY and FEAR: a hard deadline and a threat of
       suspension exist to stop you thinking. Real IT rarely does this.
   (3) Generic greeting ("Dear User"): a genuine message to you usually
       knows who you are.
   (4) Vague alarm with no specifics you can check.
   (5) The link's real destination is the look-alike domain, not a known
       Principality address. NEVER enter your password on a page reached
       this way. Hover first; here, do not click at all.
   (6) Request for SECRECY: the giveaway. Honest security work survives
       you checking with a colleague; a scam depends on you not.
  ------------------------------------------------------------------------

Now the same routine drawn as a decision flow. When a message asks you to click, open, pay, or tell, follow it from the top. Any "no" on the way to trust sends you to stop and report.

              UNEXPECTED MESSAGE asks you to
            click / open / pay / tell something
                          |
                          v
              Were you expecting it?  ---- No ----+
                          |                       |
                         Yes                      |
                          v                       |
            Is the REAL sender / number          |
            genuinely who it claims?  ---- No ----+
                          |                       |
                         Yes                      |
                          v                       |
            Does the link's REAL destination     |
            match a known address?    ---- No ----+
            (hover; do not click yet)             |
                          |                       |
                         Yes                      |
                          v                       |
            Does it pull a LURE? (urgency /        |
            authority / fear / secrecy /  -- Yes --+
            reward, or wants credentials)         |
                          |                       |
                         No                       v
                          |             +--------------------+
                          v             |   STOP.            |
            Still need to act on it?    |   Do NOT click,    |
            Then VERIFY on a separate,  |   open, pay, reply,|
            known channel before doing  |   or enter your    |
            anything that matters.      |   password.        |
                          |             |                    |
                          v             |   REPORT it through|
              Proceed only after the    |   the proper       |
              separate-channel check    |   channel.         |
              confirms it is genuine.   |                    |
                                        |   If unsure at all,|
                                        |   treat as a stop. |
                                        +--------------------+

The flow has a deliberate bias: when in doubt, it sends you to stop and report, not to proceed. That bias is correct. The cost of wrongly reporting a genuine message is a moment of someone's time. The cost of wrongly trusting a malicious one can be a compromised account on a state system. Always resolve uncertainty in favour of caution.

Reporting a suspected phishing attempt

Spotting an attack is only half the job. Reporting it is the other half, and it is what turns one person's alertness into protection for everyone. When you report a suspected phishing message, the team can warn others who received it, block the sender, and watch for anyone who was caught. A phishing run usually targets many people at once; the first person to report it protects the rest.

Report by the channel your unit has set out, which will normally be a dedicated address or button for suspected phishing, or a named person or duty role to tell. Forward or pass on the suspect message so it can be examined; do not delete it before reporting, because the message itself is useful evidence. Do not reply to the attacker, do not click "unsubscribe" or any link in it to "make it stop", and do not forward it to colleagues as a warning in a way that invites them to click it, that simply spreads the bait. Report it up the proper channel and let it be handled.

Report even when you are not sure, and report even when you did the right thing and ignored it. A message you correctly distrusted is still intelligence: it tells the team that an attack is in progress against your people. There is no penalty for reporting a message that turns out to be harmless. A force that reports freely is a force that sees attacks early; a force that reports only when certain sees them too late.

If you clicked, or gave something away

You will sometimes get it wrong. Everyone does eventually, because the attacks are designed by people who study exactly how to fool you, and a tired or busy moment is all it takes. What matters then is not that it happened but what you do in the next few minutes. The single most important rule in this whole lesson is this: if you clicked, opened, paid, or gave something away, report it at once, and do not hide it.

The instinct to hide a mistake is natural and completely understandable. It is also the worst possible response, because it gives the attacker exactly what they need most: time, and silence. The hours after a credential is phished are when the damage is done and when it can still be stopped, but only if someone knows. A password can be changed and sessions revoked before the attacker uses them; a code given away can be invalidated; a payment may be recallable if the alarm is raised fast enough; a compromised account can be locked and its access on the single sign-on cut. Every one of these defences depends on speed, and speed depends on you speaking up. An attack reported in the first minutes is often contained with no real harm. The same attack hidden for a day is a breach.

So if it happens: stop using the affected account or device for the suspect action, report immediately through the channel for incidents, say plainly what you did, clicked a link, entered a password, opened a file, made a payment, read out a code, and follow the direction you are given. Do not try to quietly fix it yourself, do not pay any further demand, and do not tamper with the evidence. You are not in trouble for reporting; you are doing the most useful thing available to you. The College and the Army treat fast, honest reporting as exactly what a good member does. The person who reports a slip in the first five minutes has very likely just protected the whole organisation, and that is the spirit in which it is received.

This is the discipline of incident response in miniature, and it carries straight into the rest of the speciality. Recognise, report immediately, do not tamper or hide, preserve the evidence, follow direction; the team then learns and improves. CIS 310 (Cyber Incident Response and Continuity) builds this into a full method, but the habit starts here, with the honesty to raise your hand the moment something has gone wrong.

In Practice: The Two-Hour Deadline

A systems assistant in the Principality is working through a busy morning when an email arrives, marked urgent, from "Kaharagia IT Support". It says suspicious activity has been found on her account and that she must confirm her password within two hours or be locked out. There is a tidy "Verify my account now" button, and the message asks her not to mention the review to colleagues while it is underway. Her first feeling is a small jolt of alarm and a wish to deal with it quickly, and she notices that feeling, because Lesson 03 told her the feeling is the alarm.

So she runs the routine instead of the button. She was not expecting this. She looks at the real sender address, not the display name, and finds it sits on a domain that is a near-copy of a Principality address, one digit off, with an odd extra word. She hovers over the button without clicking and sees the link goes to that same look-alike domain, not to the sign-in page she knows. The greeting is generic, the threat is vague, and there is that telling request for secrecy. Every part of the check points one way. She does not click, does not enter her password anywhere, and does not reply.

Then she verifies on a separate channel: she contacts the real IT duty role on the established system, not by replying to the email, and asks whether any password review is genuinely under way. It is not. She forwards the suspect message to the reporting address exactly as instructed, without clicking anything in it, and notes the time she received it. Within the hour the team has confirmed that the same email went to several members, warned everyone, and blocked the sender. One member, it turns out, had clicked and started to type a password before stopping; because that member reported it straight away rather than hiding it, his account was secured and his session revoked before anything could be done with it. By midday the attack is closed out with no harm done. Nothing about the morning required deep technical skill. It required a feeling noticed, a routine run, a separate channel used, and the honesty to report, which is the whole of the human firewall at work.

Check Your Understanding

Explain why social engineering works on careful, intelligent people, and define phishing, smishing, vishing, and pretexting, showing how the same underlying trick runs through all four. Why does the lesson say the target is never really the machine?
Name the five lures the attacker reaches for and explain how each one is meant to affect your thinking. Why does the lesson treat the feeling a message gives you as the alarm, and why is a request for secrecy an especially strong warning sign?
Walk through the checking routine for an unexpected message that asks you to act, and explain why "verify on a separate, known channel" defeats even business email compromise that carries no malicious link. Then explain what you should do if you have already clicked or given something away, and why reporting at once, rather than hiding it, is the single most important step.

Reflection (write a short paragraph): Think of a time a message, by email, text, or call, made you feel hurried, worried, flattered, or pressed to keep something quiet, whether or not it turned out to be genuine. Looking back with this lesson in mind, which of the five lures was being pulled, and which steps of the checking routine would have settled it quickly? Write honestly about what you would do differently now, and about the one habit, noticing the feeling, hovering before clicking, verifying on a separate channel, or reporting at once, that you most want to make automatic, so that on a busy morning you run the routine rather than the button.

Summary

Most breaches come not from breaking the lock but from persuading the person with the key: social engineering manipulates people, not computers, by borrowing your instincts to be helpful, to obey authority, and to act quickly. The target is never really the machine; it is you.
The family is one trick in many channels: phishing by email, smishing by text, vishing by voice, all carried by a pretext, the believable invented story. Business email compromise impersonates a trusted person to push a payment or release of information and often carries no link at all.
The lures are urgency, authority, fear, secrecy, and reward. They work on emotion, not technology, so the defence is emotional discipline: when a message makes you feel hurried, frightened, flattered, or sworn to secrecy, treat that feeling itself as the alarm and slow down.
Run the checking routine on any unexpected message that asks you to click, open, pay, or tell: were you expecting it, who is it really from, where does the link really go (hover, never trust the words), never enter credentials from a link in an unexpected message, treat unexpected attachments as dangerous, and above all verify on a separate, known channel. When in doubt, stop and report.
Report suspected phishing through the proper channel, even when unsure and even when you correctly ignored it, because the first report protects everyone else who was targeted. Do not reply, click, or delete the evidence.
If you clicked or gave something away, report at once and do not hide it: speed is what lets passwords be changed, sessions revoked, payments recalled, and access cut before harm is done. Fast honest reporting is what a good member does, not a fault.
You are the human firewall, the first line of defence that no software replaces. This lesson partners SIG 220 (Communications Security and Digital Discipline) on the disciplined mindset, builds on Lesson 02 (passwords and MFA), and leads into Lesson 10 (Spotting and Reporting Trouble) and CIS 310 (Cyber Incident Response and Continuity), where the recognise, report, do not tamper, preserve, follow direction drill becomes a full method.

Phishing and Social Engineering