Lesson 3 of 16 · Level 1: Beginner
Phishing and Social Engineering: How to Spot Them
- ⏱ 14 min read
- ❓ 4 review questions
- ✍️ Exercise with solution
In this lesson
- What phishing and social engineering are, and the forms they take: email, text, phone, QR codes and fake invoices.
- The six psychological triggers scammers use to make you act before you think.
- A checklist of red flags to inspect in any suspicious message.
- How business email compromise works and the verification habit that stops it.
- Exactly what to do (and whom to tell) when you spot or fall for a phishing attempt.
Phishing is a message that pretends to come from someone you trust so you'll click a link, open a file, share a password or send money. Social engineering is the broader art behind it: manipulating people instead of hacking machines. It works because it targets something no software update can patch, human nature. In this lesson you'll learn to read the warning signs, practice on real-looking examples and build one habit that defeats most of these scams: verify through a channel you already trust.
- Know the forms of phishing
- Recognize the triggers
- Inspect the red flags
- Verify before acting
- Report and recover
The many faces of phishing
Phishing started with email, but it now arrives through every channel you use:
| Type | Channel | Typical example |
|---|---|---|
| Phishing | Mass email | "Your account has been suspended. Log in to restore access." |
| Spear phishing | Targeted email | A message to your HR manager that names a real employee and asks for W-2 copies |
| Whaling | Email to executives | A fake legal subpoena sent to the CEO |
| Smishing | Text message | "USPS: your package is on hold, pay a $1.95 redelivery fee" |
| Vishing | Phone call or voicemail | "This is your bank's fraud department; read me the code we just texted you" |
| Quishing | QR code | A sticker over the real code on a parking meter, leading to a fake payment page |
| Business email compromise | Email from a real or look-alike business account | "We changed banks. Please send this month's invoice payment to the new account." |
Two newer twists make some attacks harder to spot. First, AI tools help scammers write fluent, typo-free messages, so "bad grammar" is no longer a reliable clue. Second, voice-cloning makes a phone call sound like your boss or a family member. The defense against both is the same: don't trust the channel the request came through; verify through a separate one.
The six psychological triggers
Almost every phishing message pushes one or more of these buttons. Learn them and you'll notice the push even when the message looks perfect.
Urgency and fear
"Your account will be closed in 24 hours." "Unusual sign-in detected."
Your move: real problems can wait ten minutes while you check them yourself.Authority
A message "from the CEO," the IRS, the police or IT support.
Your move: authority figures don't mind you verifying. The IRS doesn't demand payment by gift card.Greed and curiosity
A refund, a prize, a "shared document" or photos "of you."
Your move: if you weren't expecting it, treat it as suspicious.Helpfulness and trust
A "new coworker" who needs a password reset, a vendor in a hurry, a friend stuck abroad.
Your move: being helpful includes double-checking through a known contact.The other two triggers are scarcity ("only three spots left") and social proof ("everyone on your team has already signed"). Notice how they all aim at the same goal: making you act fast, alone and without checking.
1. At 4:50 p.m. on a Friday, an email that appears to come from your company's owner asks you to buy $1,500 in gift cards for a client and text her the codes. She says she's in a meeting and can't talk. What should you do?
Gift card requests plus urgency plus "I can't talk" is a classic impersonation scam. Replying to the same email just reaches the scammer. Verify through a separate channel you already trust.
Red flags: how to inspect a suspicious message
Here's a realistic example, followed by what to look at. It's the kind of message a Denver construction company might receive:
Subject: URGENT: updated remittance details – invoice #44817
Hello, due to an audit our bank account has changed. Please direct today's payment of $48,500 to the account in the attached form. Our old account is frozen and payments to it will be returned, causing late fees on your project. Kindly confirm once sent. Regards, Accounts Team
| Red flag | What to check | In the example |
|---|---|---|
| Sender address | The real domain, not just the display name | The real supplier uses mountainlumbersupply.com; this is a look-alike ".co" with a hyphen |
| Change of payment details | Any request to change bank info is high risk by default | "Our bank account has changed" |
| Urgency and pressure | Deadlines and threats | "Today's payment," "late fees on your project" |
| Unusual attachment or link | Forms, ZIP files, links to "view the document" | Bank details in an attached form |
| Generic signature | No named person you know | "Accounts Team" |
| Reply-only process | Asks you to confirm by replying, not by calling | "Kindly confirm once sent" |
To check a link without clicking it, hover over it on a computer (or press and hold on a phone) and read the real address. Read the domain from right to left: in login.yourbank.com.account-verify.net, the actual site is account-verify.net, not your bank. Even better, don't use links in unexpected messages at all: type the address you know or use the company's app.
If you're worried about an account, contact the company directly using a website or app you already use, or a phone number you know is correct, never the contact details in the suspicious message. Real companies generally don't email you a link to "update" your payment information.
2. Which link actually takes you to a site run by your bank, Example Bank (examplebank.com)?
The registered domain is the part right before the ending (.com, .net). In the correct answer it's examplebank.com; "online" is just a subdomain the bank controls. The others belong to secure-login.net and examplebank-support.com.
Business email compromise: the most expensive scam for companies
In BEC, criminals either spoof a look-alike address (as above) or actually break into a real email account at your company, a supplier or a client. With a real account, they can read past invoices and reply inside an existing thread, so the message looks completely normal. The money usually goes to an account that is emptied within hours or days.
The defense is a written process, not a feeling:
Case: the $48,500 invoice that never left the account
Six months before receiving the message above, the company introduced the call-back rule and ran monthly phishing simulations (fake, harmless phishing emails that teach staff to spot the real thing). When the "Mountain Lumber" email arrived, the accounts payable clerk called the number in the supplier's file. The supplier's bank hadn't changed. The payment was never sent.
Clicks fell from 9 of 50 employees to 2 of 50, and reports rose from 6 to 31. One phone call saved $48,500.
The reporting rate matters as much as the click rate. When most people report a phish quickly, IT can delete it from everyone's inbox before the few who would click ever see it.
Where the money goes
The FBI's 2025 Internet Crime Report shows that much of the $20.9 billion in reported losses came from scams that start with a message or a call:
- Investment fraud (≈41%) ≈$8.6BMostly crypto "opportunities," often started through texts, dating apps or social media.
- Business email compromise (≈14%) ≈$3.0BFake invoices and changed bank details.
- Tech support scams (≈10%) ≈$2.1BPop-ups and calls claiming your computer is infected.
- All other types (≈34%) ≈$7.2BIdentity theft, romance scams, ransomware and more.
What to do when you spot (or fall for) a phish
- Spotted itDon't click, don't replyAt work, use the "Report phishing" button or forward it to IT. At home, forward emails to ReportPhishing@apwg.org and texts to SPAM (7726), as the FTC recommends.
- Typed a passwordChange it nowFrom a clean device, change that password and any account where you reused it, and turn on MFA.
- Shared financial dataCall your bankUse the number on your card. If you shared your Social Security number, go to IdentityTheft.gov for a recovery plan.
- Opened a fileDisconnect and call ITTake the device off the network and let IT check it. Update and scan your security software.
- Lost moneyReport fastContact your bank immediately (speed improves the odds of recovering a transfer) and report at ic3.gov and ReportFraud.ftc.gov.
3. In a phishing simulation at a Charlotte accounting firm, 9 of 120 employees clicked the link. What was the click rate?
9 ÷ 120 = 0.075, or 7.5%. Track it over time along with the reporting rate; the goal is fewer clicks and many more reports.
Common mistakes
"I'd recognize a scam: they're full of typos."
AI writes clean text now. Judge the request (money, passwords, urgency), not the grammar.
Replying to a suspicious email to ask if it's legitimate.
Contact the person or company through a phone number or website you already know.
Hiding a click out of embarrassment.
Report immediately. Minutes matter, and good organizations thank people who report.
Scanning any QR code in a parking lot or restaurant.
Check for stickers placed over the original code, and prefer the official app or typing the address.
4. You get a call from "your bank's fraud team." They know your name and the last four digits of your card, and they ask you to read back a code they just texted you "to verify your identity." What's going on?
One-time codes are meant for you to type into the bank's own site or app, never to read to a caller. Hang up and call the number on the back of your card.
Practice exercise
A dental office manager in Phoenix receives this text: "Sunbelt Dental Plans Provider Services: your payment of $3,214.60 was rejected. Update your banking info within 2 hrs to avoid claim cancellation: sdp-provider-update.info/login." List at least five red flags and describe exactly what she should do.
See solution
Red flags:
- It arrives by text, an unusual channel for a dental insurer's banking changes.
- Strong urgency: "within 2 hrs."
- Fear of loss: "claim cancellation."
- It asks her to update banking information through a link.
- The domain, sdp-provider-update.info, doesn't belong to the insurer; it's a look-alike on an unrelated ending.
- A specific amount makes it feel real, a common trick to lower suspicion.
What to do: don't tap the link. Log into the insurer's provider portal by typing the address she already uses (or call the provider services number in her records) and check for any real payment issue. Forward the text to SPAM (7726), report it to the office's IT contact and warn the front desk staff, since similar messages often hit several people in the same office.
Summary
- Phishing reaches you by email, text, phone, QR code and fake invoices, and AI makes it harder to spot by writing style alone.
- Scammers push urgency, authority, greed, helpfulness, scarcity and social proof to make you act without checking.
- Inspect the real sender domain, the real link destination and, above all, the request itself.
- Business email compromise is defeated by a written rule: confirm any payment change by calling a known number.
- Report fast. A quick report protects coworkers and improves the chance of stopping a payment.
Next lesson: Passwords, Password Managers and MFA. You'll calculate how strong a password really is, set up a password manager and choose the MFA method that resists phishing.
Create your account in 30 seconds, mark your lessons and download your certificate at the end.