Phishing & Social Engineering Awareness

Attackers often don't break into systems — they trick people into handing over access. Phishing and social engineering exploit trust, urgency, and fear rather than technical weaknesses.

• Phishing messages impersonate a trusted sender (a bank, WhatsApp, an employer) asking you to click a link, "verify" details, or send money urgently.
• Red flags: Urgent language ("act now or your account is closed"), requests for passwords/PINs, links that don't match the real organization's domain, and unexpected attachments.
• Social engineering can also happen by phone or in person — someone posing as IT support asking for your password, or a "colleague" asking for an urgent money transfer.
• The golden rule: legitimate organizations never ask for your password. When in doubt, contact the organization directly through a number/website you already trust — not one from the suspicious message.

Practical Skill: Review 3 recent messages (SMS, WhatsApp, or email) you received and evaluate each against the red-flag checklist below, deciding whether you would click, ignore, or verify independently.

=== IS THIS MESSAGE A PHISHING ATTEMPT? === [ ] Does it create urgency or fear ("act now", "account suspended")?[ ] Does it ask you to click a link and "log in" or "verify"?[ ] Does it ask for a password, PIN, or OTP code directly?[ ] Does the sender's number/email look slightly wrong or unfamiliar?[ ] Does it offer something too good to be true (a prize, free money)?[ ] Is it asking you to send money urgently on someone's behalf? If you checked ANY of these -> do not click, do not reply.Verify independently using a phone number or website youalready know is real — never one provided in the message itself.