While phishing is actually a subset of social engineering, understanding their distinct characteristics and methods can help you better protect yourself online. Let’s break down both concepts and explore real-world examples.
Social engineering
Social engineering is the broader umbrella term for any manipulation technique that exploits human psychology to gain access to confidential information or systems. It’s essentially the art of manipulating people into performing actions or divulging sensitive information.
Common social engineering techniques:
- Pretexting: Creating a fabricated scenario to obtain information
For example: a scammer calls pretending to be from IT support, claiming they need your login credentials to fix a “critical system issue” – would you fall for it? - Baiting: Offering something enticing to spark curiosity
For example: a scammer leaves an infected USB drive in the school car park labelled “Confidential Salary Information” – would you pick it up? - Tailgating: Following authorised personnel into restricted areas
For example: someone dressed smartly carrying coffee cups asks you to hold the door open, claiming they forgot their access card – would you question them
Phishing
Phishing is specifically focused on obtaining sensitive information through deceptive digital communications, typically via email, text messages, or fake websites.
Common phishing types
- Email phishing
For example: Receiving an “urgent” email from your “bank” about suspicious activity, with a link to a fake login page - Spear phishing
For example: A targeted email appearing to be from your CEO, requesting an urgent money transfer - Vishing (voice phishing)
For example: Automated calls claiming your Amazon account has been compromised - Smishing (SMS phishing)
For example: Text messages about winning a prize, with links to malicious websites
The key differences
Scope
- Social engineering: Encompasses both digital and physical world tactics
- Phishing: Primarily operates in the digital realm
Approach
- Social engineering: May involve long-term relationship building and multiple techniques
- Phishing: Usually one-time, opportunistic attacks
Target scale
- Social engineering: Can be highly personalised and targeted
- Phishing: Often deployed as mass campaigns, though spear phishing is targeted
Five protection measures you should take
- Verify requests through alternative channels
- Never click suspicious links or download unexpected attachments
- Use multi-factor authentication
- Keep software and systems updated
- Train yourself and your team to recognise common attack patterns
Remember: Whether it’s phishing or other social engineering tactics, the best defence is maintaining a healthy scepticism and verifying requests through trusted channels before taking action.
These threats continue to evolve, with attackers becoming increasingly sophisticated in their approaches. If you would like to fortify your school or Trust, get ahead of attackers and stay up-to-date with evolving threats we can help – book a meeting with our team to find out about our data protection and cyber security solutions.
Stay ahead of evolving cyber threats
Attackers are getting smarter every day. Protect your school or Trust with our data protection and cyber security solutions - book a meeting with our team today.
