Social Engineering & Phishing: Email, SMS, and Phone Scams
Learn how to spot phishing, smishing, and vishing: recognize artificial urgency, lookalike domains, sensitive requests, and adopt out-of-band verification.
Why It Matters
The vast majority of successful cyberattacks begin by manipulating a human being. Breaching hardened systems is difficult; rushing someone into a mistake is easy.
Fundamentals
Social engineering exploits human emotions such as trust, fear, curiosity, and urgency. Common attack vectors include:
- Phishing: Fraudulent emails impersonating banks, shipping couriers, government agencies, executives, or trusted vendors.
- Smishing: Phishing conducted via SMS ("Your package could not be delivered to your address").
- Vishing: Voice phishing over the phone ("Calling from your bank's fraud department—please verify the security code").
- Spear phishing: Highly targeted attacks customized with your name, job title, and company context.
- CEO / Executive fraud: An attacker impersonating senior leadership requesting an "urgent, confidential payment."
Common Red Flags:
- Urgency and high pressure: "Within 1 hour," "Your account will be suspended immediately."
- Lookalike sender addresses with minor variations:
[email protected],paypa1.com. - Mismatched hyperlinks where the destination differs from the display text (hover over or long-press the link to verify).
- Unexpected attachments, invoices, or surprise "prizes."
- Any message soliciting one-time codes, passwords, or payment card details. Legitimate banks and institutions will never ask for this information over the phone or by SMS.
A Real-World Scenario
Mert, a finance specialist, receives an email that appears to come directly from the CEO: "I'm currently in a meeting. We need to issue an urgent payment of 180,000 TL to a new vendor today—keep this strictly confidential." The sender address closely mimics the corporate domain. Instead of complying immediately, Mert dials the CEO on his known internal extension; the email is confirmed to be an imposter attack.
Action Items
- Always verify requests involving money, credentials, or one-time codes via a secondary, out-of-band channel (call a known, verified number—never the number provided in the message).
- Type destination addresses directly into your browser rather than clicking embedded links.
- Report suspicious communications to your organization's security operations team before deleting them.
- Monitor threat warnings and malicious domain bulletins issued by USOM (National Cyber Incident Response Center).
Key takeaway: A message that rushes you is a message you must pause on.
*This is part 4 of the 14-part Cybersecurity Awareness series.* Next up: Password and account security: password managers, MFA, and passkeys