Email and Phishing/Social Engineering Defense
This domain tests whether you can recognize a manipulation attempt in email, messaging and voice channels, and whether you know the verification routine to use before acting. Questions often present a realistic message and ask for the first correct action.
The attack family
- Phishing is broad and untargeted; spear phishing is researched and targeted.
- Whaling targets executives; business email compromise (BEC) impersonates or hijacks a mailbox to redirect payments.
- Vishing uses voice calls, smishing uses SMS, quishing hides a payload in a QR code.
- Pretexting invents a scenario; baiting offers something attractive; tailgating is the physical cousin.
Recognition cues
A display name that does not match the address, a lookalike or typosquatted domain, a reply-to different from the sender, urgency, authority, secrecy, unexpected attachments, requests to change bank details, and links whose real destination differs from the visible text. Poor grammar is a weak signal because good attacks are well written. Attackers exploit authority, familiarity, urgency and fear rather than technical tricks alone.
Verify out of band
Use a number you already have, never the one supplied in the message. Inspect the link destination, reading the domain immediately before the first single slash from right to left. Do not enable macros or open unexpected archives, disk images or HTML attachments. Report using the official button or mailbox; do not forward the message to colleagues to ask whether it looks real.
Worked example
Finance receives an email from the finance director, in the real thread, asking for an urgent transfer to a new bank account because the supplier changed banks. Authentication checks may pass because the mailbox is genuinely compromised. The anomalies are the changed bank details, the secrecy and the pressure to skip the callback. Reasoning: the control is an independent verification against a known number using a second channel, plus the standard two-person payment approval. If money has gone, call the bank immediately and raise an incident; speed of reporting can still recall funds.
Marks that are easy to lose
- Treating a padlock or a passing SPF/DMARC check as proof of legitimacy.
- Clicking unsubscribe on spam, which confirms a live address.
- Replying to the suspicious email to ask if it is genuine.
- Assuming internal senders are always safe, which BEC disproves.