Social engineering and phishing

At 9:40 on the morning of November 3, 2026, the receptionist at Prairie Paws Veterinary Clinic forwarded an email to the Brightline help desk with one line: "Is this real?" The email appeared to come from the clinic's veterinary supply company. It said an invoice was overdue and asked her to open an attached file and sign in to confirm the amount. Jordan opened ticket BL-25102 and walked the email over to Keisha. It took her about 20 seconds to point out four warning signs. The receptionist had done exactly the right thing: she had stopped, doubted and reported.

Social engineering is the manipulation of people into doing something that helps an attacker: revealing a password, opening a file, sending money, or letting someone into a building. It works because it targets human nature rather than technology, and it is involved in a large share of real incidents. Phishing, social engineering by email or message, is the most common way attacks begin. This lesson describes the main techniques, the psychology behind them, the signs that help people recognize them, and the technical and procedural controls that reduce the damage.

Why social engineering works

Social engineers use the same levers that legitimate persuasion uses, but for harm. Authority makes people comply with someone who appears to be a manager, a police officer or the IT department. Urgency pushes people to act before they think: an account will be closed today, a payment is overdue, a package will be returned. Fear and intimidation threaten consequences. Scarcity offers something that will soon be gone. Familiarity and liking build rapport, sometimes over several messages. Social proof suggests that everyone else has already done it. Helpfulness exploits the fact that most people want to help a caller who seems to be in trouble.

The invoice email at Prairie Paws used authority, because it seemed to come from a known supplier; urgency, because the invoice was overdue; and fear, because it hinted that the clinic's account would be suspended. Keisha told Jordan that recognizing the lever is often easier than spotting the technical tricks. When a message makes you feel rushed or anxious and asks you to click, sign in, pay or share, that feeling itself is the first warning sign.

Kinds of social engineering

Newer variations use artificial intelligence. Attackers can now write fluent, error-free messages in any language, which removes the spelling mistakes that once gave phishing away. Voice cloning lets a caller sound like a known manager, and video deepfakes have been used to impersonate executives on calls. These developments make procedures more important than ever: if a payment or a password reset is confirmed through a separate, trusted channel, a convincing voice is not enough.

Business email compromise deserves special attention because the losses are large and the messages often contain no link or attachment at all. The attacker may break into a real supplier's mailbox and reply within an existing conversation, or register a domain that differs from the real one by a single letter. The request is usually simple: please update our bank details, or please send this urgent wire before the end of the day. The bakery's near miss in September, described in lesson 2, was this kind of attack. The defense is a payment-change procedure that requires confirmation by phone using a number already on file, never one given in the email.

Recognizing phishing

Keisha's four warning signs in the Prairie Paws email were typical. The display name said the supplier's name, but the actual address came from an unrelated domain. The greeting was generic. The message demanded action within 24 hours. And the button, when Jordan hovered over it without clicking, pointed to a web address that had nothing to do with the supplier. Other common signs include attachments with unusual or double file extensions, requests to enable macros, messages that ask you to sign in to read a document, and unexpected requests for gift cards or payment.

A key skill is reading web addresses. The part that matters is the registered domain just before the first single slash, read from the right. In an address such as supplies.example.com.billing-check.net/login, the domain is billing-check.net, not example.com. Lookalike domains swap letters that look alike, such as rn for m, add words like secure or support, or use a different ending. Shortened links and QR codes hide the destination altogether, so they deserve extra caution.

from urllib.parse import urlsplit
links = ["https://portal.prairievetsupply.ca/invoices/8841",
         "https://prairievetsupply.ca.invoice-review.net/login",
         "https://prairievetsuppIy.ca/pay"]
trusted = "prairievetsupply.ca"
for link in links:
    host = urlsplit(link).hostname
    ok = host == trusted or host.endswith("." + trusted)
    print(f"{host:<42} {'matches' if ok else 'DOES NOT MATCH'} {trusted}")

portal.prairievetsupply.ca                 matches prairievetsupply.ca
prairievetsupply.ca.invoice-review.net     DOES NOT MATCH prairievetsupply.ca
prairievetsuppiy.ca                        DOES NOT MATCH prairievetsupply.ca

The program checks whether each link's host name really belongs to the trusted domain. The second link starts with the supplier's name but actually belongs to invoice-review.net. The third uses a capital I in place of a lowercase l, which looks almost identical in many fonts. Mail security tools apply this kind of check automatically, along with many others, but people still need to recognize the pattern.

Technical controls

Email authentication standards help receiving servers detect forged senders. SPF, the Sender Policy Framework, lets a domain publish a list of servers allowed to send its mail. DKIM, DomainKeys Identified Mail, adds a digital signature to outgoing messages so that receivers can check that a message really came from the domain and was not altered. DMARC, Domain-based Message Authentication, Reporting and Conformance, tells receivers what to do when a message fails those checks, such as reject it or send it to quarantine, and sends reports back to the domain owner. Together they make it much harder to send mail that pretends to come from a protected domain, although they do nothing against lookalike domains.

Other technical controls include mail filters that scan links and attachments and hold suspicious messages; banners that mark messages from outside the organization; web filtering that blocks known phishing sites; sandboxing that opens attachments in an isolated environment to see what they do; and, most importantly, multi-factor authentication, so that a password typed into a fake page is not enough to sign in. Phishing-resistant methods, such as security keys and passkeys, go further because they will not work on a lookalike site at all. Lesson 10 covers these.

Procedures and people

Technology catches most phishing but never all of it, so procedures and people form the last layer. Staff need to know what to look for, and they need a quick, blame-free way to report. Brightline gives every client a report button in their mail program that sends the message straight to the help desk. Keisha emphasizes that reporting a message that turns out to be safe is a success, not a waste of time, and that someone who clicks and then reports quickly has helped rather than failed. Early reports let the team block a campaign before others are caught.

Procedures close the gaps that attackers rely on. Payment details are changed only after confirmation through a known phone number. The help desk verifies a caller's identity before resetting a password, using a method the attacker is unlikely to know. Visitors sign in and are escorted. Doors are not held open for people without badges. Unknown USB devices go to IT rather than into a computer. Many organizations also run simulated phishing exercises, sending harmless test messages and using the results to target training, though these work best when they are used to teach rather than to shame.

Social engineering in person

Not all social engineering arrives by email. A person in a high-visibility vest carrying a ladder can walk into many offices unchallenged. A caller who says they are from the internet provider and need a technician let into the server cupboard may sound perfectly reasonable. Shoulder surfing, watching someone type a PIN or password, works in reception areas and on buses. Dumpster diving, going through discarded paper, still finds invoices, client names and even printed passwords.

The defenses are mostly habits. Staff should feel comfortable asking a visitor who they are there to see and calling to check, even when the visitor seems confident. Contractors should be expected, logged and escorted. Screens in public areas should face away from visitors or have privacy filters. Paper with personal or client information should be shredded. At Prairie Paws, Keisha suggested a simple sign at the reception desk asking anyone claiming to be from IT to wait while staff call Brightline to confirm, which costs nothing and stops most in-person pretexts.

Measuring awareness

Brightline measures the success of awareness work by the reporting rate as much as the click rate. A client where few people click but nobody reports is in a weaker position than one where a few people click but most report quickly, because early reports let the team block a campaign for everyone. After the November campaign, the clinic's reception staff had the highest reporting rate of any Brightline client, and the receptionist who reported ticket BL-25102 was thanked by name at the next staff meeting.