Beginner · Security basics · topic 4 of 43 · 30 min
Phishing and social engineering
Explanation
Why attackers target people
Breaking strong encryption is very hard. Asking someone for their OTP is easy. That is why most real attacks start with a person, not a machine. Social engineering is the art of manipulating people into doing something that helps the attacker: sharing a password, approving a payment, installing an app or opening a door.
Attackers use normal human feelings: fear ("your account will be blocked"), urgency ("within 2 hours"), greed ("you won a prize"), helpfulness ("I am new, can you help me log in?") and authority ("this is the police / your CEO").
Kinds of phishing
| Name | Channel | Typical Indian example |
|---|---|---|
| Phishing | "Your income tax refund is ready, click to claim" | |
| Smishing | SMS | "Dear customer your KYC is expired, update now: short link" |
| Vishing | Voice call | A fake "bank officer" asking for an OTP to "stop a fraud" |
| Spear phishing | Targeted email | A message to an accounts clerk that names her manager and a real vendor |
| Whaling | Targeted at top bosses | A fake legal notice sent to a company director |
| Business email compromise (BEC) | Email from a real or look-alike business account | "Vendor" asks to change the bank account for the next payment |
| Quishing | QR code | A sticker over a shop's real UPI QR code |
Scams common in India
- KYC update SMS with a link to a fake bank page that asks for card details and OTP.
- UPI collect requests: a stranger "sends" money but it is really a request to take money. You never need your PIN to receive money.
- Fake electricity bill messages saying power will be cut tonight unless you call a number.
- "Digital arrest" calls: fraudsters pretend to be police or customs on a video call and demand money to "clear your name". Real police do not arrest people over video calls.
- Fake job and part-time task offers that ask for a "registration fee".
- Screen-sharing apps: a "support agent" asks you to install an app so they can see your screen and your OTPs.
How to check a message
- Slow down. Urgency is the attacker's main tool.
- Check the sender: the real email domain, not just the display name. "SBI Support <alerts@sbi-kyc-help.example>" is not your bank.
- Check the link before clicking: on a computer, hover; on a phone, long-press. Read the domain from right to left. In "mybank.example.verify-login.example", the real domain is verify-login.example, not mybank.
- Never share OTP, PIN, CVV or passwords, whoever asks.
- Verify using a channel you choose: call the number on the official website or the back of your card, not the one in the message.
from urllib.parse import urlparse
url = "https://mybank.example.kyc-update.example/login"
host = urlparse(url).hostname
print(host)
print(host.endswith("mybank.example"))What defenders do
- Email filters and link scanning.
- SPF, DKIM and DMARC: DNS records that let mail servers check whether an email really came from the domain it claims (covered in the DNS lesson).
- Phishing-resistant MFA, so a stolen password is not enough.
- Awareness training and practice phishing tests.
- A simple "Report phishing" button, and a culture where reporting a mistake is praised, not punished.
- Payment rules such as a call-back to a known number before changing any vendor bank account.
Common mistakes
- Trusting the display name. Anyone can set their name to "HDFC Bank".
- Thinking the padlock icon means a site is safe. It only means the connection is encrypted; criminals can get certificates too.
- Being ashamed to report. The sooner a click is reported, the less damage is done.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Phishing and social engineering · 1/7
Most attacks start with a person, not a machine. Tricking people is called social engineering.
Prefer a video by a teacher? Find free videos on “how to spot phishing smishing vishing scams India” on YouTube ↗
In real life: The changed bank account
An accounts executive at a Chennai exporter gets an email that looks like it is from a long-time supplier: "Our bank has changed, please pay this month's invoice to the new account." The domain is one letter different from the real one. Because the company has a rule to call the supplier on the number already on file before any bank change, the executive calls, the supplier says they sent nothing, and ₹18 lakh is saved. This is business email compromise, and the defence was a process, not a tool.
Practice (0/3 done)
An SMS says: "Your electricity will be disconnected tonight at 9:30 pm. Call officer 98xxxxxx immediately." What is the strongest warning sign?
Write link_is_official(url, official) that returns True only if the link's host is exactly the official domain or a sub-domain of it (it ends with "." + official). Use urllib.parse.urlparse(url).hostname. Lower-case the host first.
Find two real spam or phishing messages in your own SMS or email (do not click anything). For each, list every warning sign and write what the safe action is.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Ethics and the law: permission firstSecurity basics · same module
- Threats, vulnerabilities and riskSecurity basics · same module
- Login with Google, OTP and passkeysBackend Development · Authentication and authorization
- Interviews, CVs and honest salary expectationsCareers and certifications
- The law in India: IT Act 2000, sections 43 and 66Ethical Hacking and Penetration Testing (legal labs) · Rules first: ethics, law and permission
- A SOC analyst's day and playbooksLogs, SIEM and incident response
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
What is vishing?
Answer: Phishing by voice call
Vishing is voice phishing: a scam phone call.
Which link really belongs to mybank.example?
Answer: https://secure.mybank.example/login
secure.mybank.example ends with .mybank.example, so it is a sub-domain of the bank.
A "supplier" emails asking you to send this month's payment to a new bank account. What is the best control?
Answer: Call the supplier on the number already on file before changing anything
Verify through a channel you already trust. Replying goes straight back to the attacker.
Someone sends you a UPI request and says "enter your PIN to receive ₹5,000". This is…
Answer: A scam: a PIN is only needed to send money
Entering your PIN approves a payment out of your account.
What does the padlock in the browser address bar prove?
Answer: The connection to that site is encrypted
HTTPS only protects the connection. Phishing sites can have a padlock too.
Why are passkeys hard to phish?Related
Answer: The private key stays on the device and only works on the real website domain
The browser ties a passkey to the real domain, so a fake site cannot use it, and the private key never leaves the device.
What is a realistic fresher SOC L1 salary range in India?Related
Answer: Roughly ₹3–8 LPA, varying by city and company
Most fresher SOC offers fall in this broad range.
Phishing (pretending to be a bank to cheat someone online) is often charged under…Related
Answer: Section 66D
66D covers cheating by personation using a computer resource.
What should you do first with a reported phishing email?Related
Answer: Get the original email with full headers
You need the original with headers as evidence; never click links on your own machine.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 1 more topic in “Security basics” before its exam: Ethics and the law: permission first.
- Module 1 exam: Security basics · 13 questions · 20 min, without help. 5 topics of this module still to finish first.
- Then the next module, Networking for security. 43 topics left in the course before the final exam.