Social engineering cheat sheet
Phishing
A fake email or message sent broadly, trying to trick recipients into clicking a link, opening an attachment, or handing over credentials.
Spear phishing
Phishing aimed at a SPECIFIC person or small group. Uses real names, real projects, real coworkers to look legitimate.
Vishing
Voice phishing. A phone call pretending to be IT, the bank, the IRS, etc., pressuring you to act fast.
Smishing
SMS phishing. A text message with a suspicious link, often pretending to be a shipping notice, account alert, or password reset.
Tailgating
Physically following an authorized person through a locked door so you do not have to badge in yourself.
Shoulder surfing
Watching someone over their shoulder as they type a password, PIN, or other sensitive information.
Fear
"Your account will be locked." Drives people to act before thinking.
Urgency
"Respond within 1 hour." Prevents people from verifying.
Trust
"It looks like it is from my boss." Hijacks an existing relationship.
Curiosity
"See who viewed your profile." Bait you cannot resist clicking.
Authority
"This is IT. We need your password." Uses position to bypass questions.