27. Social Engineering Awareness
27.1 What Social Engineering Is and Why It Works
In short: Social engineering is manipulating people into giving up information or access – no exploit needed, just human nature.
Social engineering is manipulating people into giving up information or access – no exploit needed, just human nature. Attacker technical suraksha baju la sarun thet mansala target karto.
It works because attackers push psychological buttons:
| Trigger | How it is used |
|---|---|
| Authority | "I am calling from the bank / your manager / income tax." |
| Urgency / fear | "Your account will be blocked in 10 minutes!" |
| Greed / reward | "You won ₹10,00,000 – click to claim." |
| Trust / familiarity | A message that looks like it is from a friend or a known company |
| Helpfulness | "I am new here, can you just let me in / share the OTP?" |
| Curiosity | A USB drive labelled "Salary details" left in the office |
Ravindra Bagale's Tip
Remember: no genuine bank, company or government office will ever ask for your OTP, password or PIN over the phone. If anyone asks for it, it is 100% fraud – no matter how "official" it seems. Make sure you teach this one rule to your family.
Ravindra Bagale's Tip – मराठी
लक्षात ठेवा: कोणतीही खरी bank, company किंवा government तुमचा OTP, password किंवा PIN phone वर कधीही विचारत नाही. कोणी हे विचारले म्हणजे तो 100% fraud आहे – कितीही "official" वाटला तरी. हा एक नियम तुमच्या कुटुंबाला आवर्जून शिकवा.
Ravindra Bagale's Tip – हिंदी
याद रखो: कोई भी असली bank, company या government आपका OTP, password या PIN phone पर कभी नहीं पूछती. कोई यह पूछे तो वह 100% fraud है – चाहे कितना भी "official" लगे. यह एक नियम अपने परिवार को ज़रूर सिखाओ.
Practice task
In your notes, list three times you or someone you know got a suspicious call or message. For each, write which psychological trigger (authority, urgency, greed...) the attacker used.
Social engineering against real organisations
Social engineering attacks people instead of code. It works because people want to be helpful under pressure.
Example 1: Indian company (sample)
A caller tells an accounts clerk at a Pune SME, "I am from your bank's fraud team, share the OTP now." The clerk is busy. Training that says banks never ask for OTPs stops the fraud.
Example 2: global
Deepfake audio has been used in reported cases to impersonate executives and approve transfers. Companies now verify large payments on a second channel.
Example 3: everyday
A "courier" asks you to confirm your card number to "reschedule delivery". Hang up and call the courier's official number from the app.
Defences that work
- Verify unusual requests on a known-good channel.
- Never share OTPs, passwords or seed phrases.
- Report phishing to the security team; do not just delete it.
- Run short, regular awareness drills.
Recap
- Pressure + urgency + authority is the classic pattern.
- Slow down and verify.
Defender's worksheet (do this today)
- Write the lesson title and date in your notebook.
- List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
- Run one safe command or checklist item from the lesson on a lab system only.
- Paste the command and its output under an Evidence heading.
- Write one fix you would give a teammate in two sentences.
- Write one mistake students make with this topic and how to avoid it.
More real-world pictures
Indian workplace (sample data)
Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.
Global practice
Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.
Home and family
Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.
Connect to earlier chapters
Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.
Common mistakes
- Skipping written permission just for a quick scan.
- Practising on hostel or office Wi-Fi targets without authorisation.
- Collecting tool output without writing the fix.
- Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.
Recap
- Evidence, fix, owner, date.
- Own lab only.
- Teach one other person the warning from this lesson.