🛡 Paper 2 · 3.6 Cyber Security
3.6.2 Social Engineering
AQA 8525 · GCSE Computer Science · ~10 min read
Notes
──
Video
──
Worksheet
──
Quiz

What is Social Engineering?

Social engineering is the manipulation of people rather than technical systems to gain unauthorised access to information or systems. It exploits human psychology — trust, authority, urgency, and fear — rather than software vulnerabilities.

It is often the easiest form of attack: it is much simpler to trick a person into revealing a password than to crack it technically. This is why people are often described as the "weakest link" in cyber security.

Psychological Triggers Used

Social engineers are skilled at exploiting these cognitive biases:

⚡ Urgency ("Act now or your account will be closed!")
👔 Authority ("This is IT support, we need your password.")
😰 Fear ("Your computer has been hacked!")
🤝 Trust ("I'm calling from your bank.")
🎁 Greed ("You've won a £500 gift card!")
❓ Curiosity ("Watch this video…")

Types of Social Engineering Attack

Email

Phishing

Mass emails disguised as legitimate sources (banks, PayPal, HMRC) containing malicious links or attachments. Targets large numbers of people — even a 1% success rate yields thousands of victims.

Targeted email

Spear Phishing

A targeted phishing attack aimed at a specific individual or organisation. Uses personal details (name, job title, colleagues) gathered from LinkedIn or social media to appear convincing. Far more effective than mass phishing.

Voice

Vishing (Voice Phishing)

Phone calls from attackers impersonating banks, IT support, HMRC, or even Microsoft. Common scripts: "Suspicious activity on your account — we need to verify your details" or "Your computer has a virus, give us remote access."

SMS

Smishing (SMS Phishing)

Fake text messages pretending to be from delivery companies, banks, or HMRC with links to fake websites. Example: "Your Royal Mail parcel could not be delivered. Pay £2.99 redelivery fee here: [link]"

Physical

Baiting

Leaving infected USB drives in car parks, offices, or public places, labelled with enticing names ("Payroll 2025", "Confidential"). When a curious person plugs it in, malware installs automatically.

In-person

Blagging

Creating a fabricated scenario to obtain information from a target — for example, an attacker poses as a new IT contractor and asks an employee to reveal their password so they can "fix" their computer. (Also known as pretexting.)

Physical

Tailgating

Following an authorised person through a secure door without using their own credentials. Common in offices with key fob access — attacker holds the door saying "I forgot my badge." Also called piggybacking.

In-person

Shoulder Surfing

Observing someone entering their PIN, password, or sensitive information in a public place — over their shoulder. Common at ATMs, train stations, and open-plan offices.

Phishing Email — Signs to Spot

From: security@barcIays-bank.supportmisspelled domain (capital I not l)
Subject: URGENT: Your account has been suspendedurgency trigger

Dear Customer, ← generic greeting (not your name)

We have detected suspicious activity on your account. You must
verify your details within 24 hours or your account will be
permanently closed.fear + urgency

Click here to verify: http://barcIays-secure-verify.xyz/loginfake URL

Countermeasures

Education

📚 Staff Training

Regular awareness training — teach employees to recognise phishing emails, vishing calls, and suspicious scenarios. Run simulated phishing exercises. Humans are the threat; make them the defence.

Verification

📞 Verify Before Acting

Never act on unexpected requests without independent verification. Call the company back on a number you find independently (not one given in the suspicious message). IT support should never ask for passwords.

Policy

📋 Clear Policies

Define exactly what employees should and should not do: no sharing passwords, no tailgating, no plugging in unknown USB devices. "Clean desk" policy prevents shoulder surfing. Formal visitor sign-in procedures.

Technical

🔧 Technical Controls

Email spam filters, anti-phishing browser extensions, multi-factor authentication (so stolen passwords alone aren't enough), physical access controls (key fobs, security guards, sign-in procedures).

Exam tip: A common question is "explain one social engineering technique." Know: phishing (fake email), spear phishing (targeted), vishing (phone), smishing (SMS), baiting (USB), blagging (false scenario), tailgating (door), shouldering (shoulder surfing). For each: describe what it is, how it works, and one way to prevent it. Remember: social engineering targets humans, not systems — prevention is about education and policy.
⚠️ Common Mistakes
  • Saying phishing "hacks the server directly" — phishing tricks HUMANS into giving up credentials. It exploits people, not technical vulnerabilities.
  • Confusing phishing with spear phishing — phishing is mass/untargeted; spear phishing is specifically targeted using personal information about the victim.
  • Saying "use antivirus" to prevent phishing — antivirus doesn't stop someone from being tricked into entering their password. Staff training and verification procedures are the countermeasures.
Video coming soon

Key points

  • Social engineering manipulates people, not systems — people are often the weakest link
  • Phishing (email), spear phishing (targeted), vishing (voice), smishing (SMS)
  • Baiting (USB drops), blagging (false scenario), tailgating (follow through door), shoulder surfing
  • Psychological triggers: urgency, authority, fear, trust, greed, curiosity
  • Prevention: staff training, verification procedures, clear policies, 2FA, spam filters
Click slide or press arrow keys to navigate
✍️

Worksheet — 3.6.2 Social Engineering

8 questions · 22 marks

Q1Define social engineering and explain why it is often considered the easiest form of cyber attack.[3]
✅ Mark scheme
Mark scheme
Social engineering is the manipulation of people to gain unauthorised access to information or systems [1]; it exploits human psychology (trust, authority, fear) rather than technical vulnerabilities [1]; it is often easier than technical attacks because it is simpler to trick a person into revealing credentials than to crack them technically — people are the "weakest link" in cyber security [1].
Q2Explain the difference between phishing and spear phishing.[2]
✅ Mark scheme
Mark scheme
Phishing sends mass untargeted emails to large numbers of people pretending to be from a trusted source, hoping some will click [1]; spear phishing is targeted — it aims at a specific individual or organisation, using personal details (name, job title, company) gathered from social media to make the attack more convincing and effective [1].
Q3Describe how a baiting attack works. What psychological trigger does it exploit?[3]
✅ Mark scheme
Mark scheme
A baiting attack involves leaving infected USB drives in accessible locations (car parks, offices) [1]; the drives are often labelled with enticing names like "Salary Data" or "Confidential"; when a person plugs it in, malware automatically installs on their computer [1]; it exploits curiosity — people cannot resist finding out what is on the drive [1].
Q4What is tailgating (also called piggybacking) in the context of social engineering?[2]
✅ Mark scheme
Mark scheme
Tailgating (piggybacking) is when an unauthorised person gains physical access to a secure area by following an authorised employee through a secure door [1]; the attacker typically says something like "I forgot my key card" or simply walks in while the employee holds the door open out of politeness [1].
Q5Give three psychological triggers that social engineers exploit and explain how each is used.[3]
✅ Mark scheme
Mark scheme
Any three: Urgency — "Act now or your account will be suspended" — pressure to act quickly before thinking critically [1]; Authority — "This is IT support, I need your password to fix your computer" — people comply with apparent authority figures [1]; Fear — "Your computer has been hacked" — panic stops rational evaluation [1]; Trust — impersonating a bank, employer, or trusted organisation [1]; Greed — "You've won a prize, click here to claim" [1]; Curiosity — labelling a USB drive "Salary Spreadsheet" to make people plug it in [1].
Q6List four signs that an email might be a phishing attempt.[4]
✅ Mark scheme
Mark scheme
Any four: misspelled sender domain (e.g. barcIays.com with capital I) [1]; generic greeting ("Dear Customer" rather than your name) [1]; urgent language ("Act immediately or your account will be closed") [1]; suspicious link URL (hover shows different domain, .xyz, misspellings) [1]; grammar/spelling errors in the body [1]; unexpected request for personal information or passwords [1].
Q7What is vishing? Give an example of how it might be carried out.[2]
✅ Mark scheme
Mark scheme
Vishing (voice phishing) is a social engineering attack carried out by phone, where the attacker impersonates a trusted organisation [1]; example: caller claims to be from the victim's bank, says suspicious activity has been detected, and asks them to "verify" their account number, card details, or online banking password [1].
Q8A company is concerned about social engineering attacks. Suggest three countermeasures and explain how each one helps.[3]
✅ Mark scheme
Mark scheme
Any three: staff training — employees learn to recognise phishing/vishing and respond correctly; reduces the chance of an attack succeeding [1]; verification procedures — always independently verify unexpected requests (call back on known number, not the number given in the message) [1]; clear policies — no sharing passwords, no tailgating, no unknown USB devices; removes ambiguity about acceptable behaviour [1]; two-factor authentication — even if credentials are stolen via social engineering, the attacker still can't log in without the second factor [1]; physical security (sign-in, security guards) — prevents tailgating [1].
Check your answers above.
Topic Quiz
Q 1 of 10
You scored
out of 10
Card 1 of 8
Click to flip
🎉
All done!
TermDefinition
🎯

Mini Test — 3.6.2 Social Engineering

Timed exam conditions.

  • 8 questions · 10 minutes
  • 5 MCQ + 3 short answer
← 3.6.1 Forms of Cyber Attack
48 of 57 · AQA 8525
3.6.3a Cyber Security Measures →