Mission 09
Phishing, Smishing and Social Engineering
Most attacks on small businesses start with a message or a call that pushes someone to act fast. Learn the pressure cues behind phishing, smishing and vishing, and the simple habit that beats them: pause, verify through a known channel and report.
In this mission you will
- Recognise the common pressure cues of social engineering: urgency, authority, familiarity, fear and secrecy.
- Identify typical patterns such as fake KYC updates, courier messages, electricity-bill threats and fake job offers across email, SMS, chat and phone.
- Verify an unusual request using a known, independent contact method instead of the details in the message.
- Report suspicious messages quickly through the agreed route without clicking, replying or forwarding them around.
Attackers target people, not just computers
Social engineering means tricking a person into doing something that helps the attacker: clicking a link, opening a file, sharing an OTP, changing bank details or sending money. It is often easier than breaking into a system. Phishing is the email version. Smishing uses SMS. Vishing uses voice calls. The same tricks also arrive on WhatsApp, social media and even video calls. The channel changes, but the method stays the same: create pressure so you act before you think.
The pressure cues to watch for
- Urgency: 'Today only', 'within 30 minutes', 'your account will be blocked'. Time pressure is designed to stop you checking.
- Authority: the message claims to be from the owner, a director, a bank, a tax office, the police or a big customer.
- Familiarity: it uses a known name, a familiar logo or a real-looking thread, or it comes from a contact whose account may have been taken over.
- Fear or reward: a penalty, a disconnection, a legal notice, or a prize, refund or job that seems too good.
- Secrecy and process bypass: 'Don’t tell anyone', 'I’m in a meeting, just do it', 'skip the usual approval this once'.
- Unusual requests: asking for passwords, OTPs, remote access, gift cards, a new beneficiary or a change to bank details.
Links, attachments and look-alikes
A sender name can say anything. The display name 'Accounts Team' may hide a completely unrelated address. Links can show one text but go somewhere else, and look-alike web addresses swap or add a single letter. Attachments such as 'invoice', 'purchase order' or 'payment advice' may contain harmful files or lead to a fake sign-in page. A padlock or 'https' only means the connection is encrypted. It does not prove the site is genuine. Instead of trusting what the message shows you, go to the service yourself, using a saved bookmark, the official app or a number you already have.
The pause, verify, report habit
- 1Pause. Notice the pressure cue. A genuine request can wait two minutes.
- 2Do not click, open, reply or call back using the details in the message.
- 3Verify through a known channel: call the person on the number saved in your records, open the official app, or walk across and ask.
- 4Follow your normal approval rules, especially for payments, bank detail changes and access requests. No exceptions for 'urgent' requests.
- 5Report it through your agreed route, for example to the owner, manager or IT support, even if you are not sure. Share a screenshot or forward as instructed. Do not forward it to colleagues as a warning chain.
- 6If you already clicked, entered details or paid, say so immediately. Speed matters far more than embarrassment.
Reporting is a strength, not a confession
Every report helps. One person reporting a fake KYC message can warn the whole team before anyone else falls for it. In a healthy workplace, staff are thanked for reporting, including when they reported something that turned out to be genuine, and including when they reported their own mistake. Owners and managers should say this out loud. Fear of blame is what turns a small click into a large loss.
Practical business example
The electricity-bill SMS at Lakshmi Engineering Works
Lakshmi Engineering Works is a fictional 18-person machine shop in Coimbatore. On a busy Friday evening, the supervisor Arun received an SMS saying the factory’s power would be disconnected at 9:30 pm because last month’s bill was not updated. It gave a mobile number to call. A night shift was planned, so Arun felt the pressure. He called. A polite man asked him to install a 'bill update' app and pay a small amount to restore the record. Arun hesitated, remembering the team rule: verify through a known channel. He hung up and checked the bill payment history in the utility’s official app, which the accountant Kavitha had shown everyone. The bill was paid. Arun forwarded a screenshot of the SMS to the owner, who shared it in the staff group as a warning, thanking Arun by name for pausing.
The lesson: Urgency plus authority plus a believable story is the classic pattern. Arun’s pause and an official channel he already knew turned a likely loss into a useful warning for the whole team.
Key takeaways
- Social engineering works by creating pressure: urgency, authority, familiarity, fear or reward, and secrecy.
- The same tricks arrive by email, SMS, WhatsApp, phone calls and video. Judge the request, not the channel.
- Never verify through the message itself. Use a saved number, the official app or a known person.
- Requests for OTPs, passwords, gift cards, remote access or new bank details always need verification and normal approval.
- Report suspicious messages, and your own mistakes, quickly. Reporting is valued, not punished.
Scenario lab · +25 XP
The secret gift-card request
You work in the office of Saffron Trails, a fictional 12-person travel agency in Jaipur. At 4:45 pm you receive a WhatsApp message from a new number with the owner Mrs Rathore’s photo: 'I’m in a client meeting and can’t talk. I need 10 gift cards for a client gesture urgently. Buy them now and send me the codes. Keep this between us, it’s a surprise.'
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
What do you notice first?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Spot the signals in three fictional messages
Practise the pause-and-verify habit using made-up examples. Do not use real messages that contain customer names, account numbers or any personal details, and never open real suspicious links for this exercise.
- 1.Write three short fictional messages your team might plausibly receive, for example a KYC update SMS, a supplier bank-change email and an 'owner' asking for urgent help on chat.
- 2.For each, list the pressure cues you can see: urgency, authority, familiarity, fear or reward, secrecy, unusual request.
- 3.For each, write the known channel you would use to verify it, such as a saved number or official app.
- 4.Confirm who in your business receives reports of suspicious messages, and how to reach them.
- 5.Share the three examples and the reporting contact with your team in a short huddle or message.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress