27. Social Engineering Awareness
27.2 Types of Social Engineering
| Type | Channel | Example |
|---|---|---|
| Phishing | A fake "your KYC expired" email with a link to a lookalike bank site | |
| Spear phishing | Email, targeted | A personalised mail to one employee, using their real name and role |
| Vishing | Voice call | "Bank officer" asking for OTP to "stop a fraudulent transaction" |
| Smishing | SMS | "Your parcel is held, pay ₹15 here: [link]" |
| Pretexting | Any | A made-up story ("I am from IT support") to gain trust |
| Baiting | Physical/USB | A malware-loaded USB left where someone will plug it in |
| Tailgating | Physical | Following an employee through a secure door without a badge |
| Quid pro quo | Any | "Free tech support" in exchange for access |
Most real attacks start with one of these, then use the technical tools from earlier chapters. The human is the entry point.
Ravindra Bagale's Tip
"Phishing fakt email madhe aste" ha gairsamaj aahe. Aajkal SMS (smishing) ani WhatsApp var sarvat jast fasavnuk hote – courier, electricity bill, KYC. Channel kontahi aso, niyam ekach: link var ghai ne click karu naka, aani OTP konalahi deu naka.
Practice task
Match each of these to its type: a call claiming to be from the electricity board threatening disconnection; a USB drive found in the parking lot; an SMS about a held courier. Write the type and the trigger for each.