Cybersecurity Tutorial — Phishing & Social Engineering (2026)

Technology can be patched; humans can be persuaded. Social engineering — manipulating people into revealing secrets or taking unsafe actions — remains one of the most effective attack methods. In 2026, AI makes phishing emails flawless and voice clones frighteningly real. Lesson 3 teaches you to recognize and resist these attacks.

Prerequisites: Lessons 1–2 recommended. Estimated time: 50–60 minutes.

1. What Is Phishing?

Phishing is fraudulent communication designed to steal credentials, money, or malware installation. Variants include:

Type	Channel	Example
Email phishing	Email	Fake “Your package failed delivery” link
Spear phishing	Email	Targeted email using your name and company
Whaling	Email	CEO fraud targeting executives
Vishing	Phone / VoIP	Fake bank fraud department call
Smishing	SMS	“Verify your account” text with malicious link
Quishing	QR code	Malicious QR on parking meter or email

2. How AI Supercharges Phishing

• Perfect grammar in any language — no more obvious typos
• Personalization at scale — scraped LinkedIn data inserted into templates
• Voice cloning — “Your manager” on a Teams call asking for a wire transfer
• Chatbot lures — fake support bots on social media
• Deepfake video — synthetic face in a video meeting (see Lesson 7)

The old advice “look for bad spelling” is insufficient. You need process-based verification.

3. Red Flags Checklist

• Urgency or threats (“Account locked in 1 hour!”)
• Unexpected attachments (.html, .zip, .iso, macro-enabled Office files)
• Sender address that almost matches a real domain (paypa1.com vs paypal.com)
• Links that differ from displayed text — hover before clicking
• Requests for passwords, MFA codes, or gift cards
• Unusual payment instructions changing at the last minute

4. Verify Out-of-Band (The Golden Rule)

Before sending money, sharing credentials, or changing bank details:

1. Stop — do not act on the message alone
2. Contact the person or organization through a known channel (phone number on official website, in-person, prior email thread)
3. Confirm the request independently

This single habit defeats most BEC (business email compromise) and AI voice scams.

5. Reading Email Safely (Intermediate)

View full headers or use your mail client’s “show original” to inspect:

• From vs Return-Path mismatch
• SPF/DKIM/DMARC fail results (not foolproof, but useful signals)
• Recently registered domains in links

When in doubt, forward suspicious work email to your security team — do not click links first.

6. What to Do If You Clicked or Responded

1. Disconnect from network if malware is suspected
2. Change passwords from a clean device — start with email
3. Revoke active sessions in account security settings
4. Enable or reset MFA
5. Report to IT, your email provider, or FTC Report Fraud (US)
6. Document timeline for incident response (Lesson 8)

7. Building a Phishing-Resistant Culture

Organizations run simulated phishing exercises — not to punish, but to train. At home, discuss scams with family members, especially seniors targeted by tech-support fraud.

8. Scenario: The Urgent CEO Wire Transfer

Friday 4:47 PM — Email from “CEO” asks you to wire $48,000 to a new vendor before markets close. Reply-to address is slightly off. Phone number in signature is mobile.

Correct response: Do not wire. Call the CEO on the number in the corporate directory. Confirm in person if possible. Report to finance and security. This is classic whaling — AI makes the writing polished, but the process break is the same.

9. Next Steps

Continue to Lesson 4 — Privacy and Data Protection.

Frequently Asked Questions

Can AI make phishing harder to detect?
Yes. AI generates convincing text, voice, and even video. Always verify sensitive requests through a second, trusted channel.

What should I do if I clicked a phishing link?
Assume compromise: change passwords from a clean device, enable MFA, revoke sessions, and report the incident.

Are spam filters enough?
No. Some phishing reaches the inbox. User awareness and verification processes are essential layers.