AQA 8525 · Section 3.6 · Cyber Security

Social
Engineering

Phishing · Pretexting · Baiting · Shoulder Surfing · Vishing

CSZoneAQA GCSE Computer Science 8525

What is Social Engineering?

Exploiting People, Not Technology

Social engineering is the manipulation of people into performing actions or revealing confidential information. Instead of hacking systems directly, attackers exploit human psychology — trust, fear, urgency, or authority — to bypass security controls.

Technical defences (firewalls, encryption) cannot protect against social engineering — humans are the weakness

Countermeasure: user education and security awareness training

Types of Social Engineering

Common Techniques

Phishing — fraudulent email pretending to be a trusted source (bank, HMRC). Contains link to fake website harvesting credentials.

Spear phishing — targeted phishing using personal details about the victim to appear more credible.

Vishing — phishing via voice/phone call. Attacker pretends to be bank/IT support.

Pretexting — creates a fabricated scenario (pretext) to gain trust and extract information (e.g. "I'm from IT, I need your password")

Shoulder surfing — physically observing someone entering passwords or PINs

Baiting — leaving infected USB drives in public places, hoping someone will plug them in

Preventing Social Engineering

Defences Against Human Manipulation

Staff training — teach employees to recognise phishing, verify callers, question unusual requests

Clear policies — never share passwords over phone/email; verify identity through official channels

Two-factor authentication — even if a password is obtained, account still protected by 2FA

Email filters — spam/phishing detection tools flag suspicious emails before they reach staff

Exam Practice

Have a go at this question

AQA-style question

Describe how a phishing attack works and explain one way to protect against it.

3 marks

A phishing attack involves sending a fraudulent email that appears to come from a trusted organisation [1], containing a link to a fake website that captures login credentials when the victim enters them [1]. Protection: staff training so employees can recognise suspicious emails and verify links before clicking [1].

Key Takeaways

What to Remember

Social engineering exploits people, not technology — trust, fear, authority

Phishing (email) · Vishing (voice) · Spear phishing (targeted)

Pretexting (fake scenario) · Baiting (infected USB) · Shoulder surfing

Best defence: user education and security awareness training