Learning Objectives
- Describe the processes and aims of pharming and phishing.
- Explain social engineering as manipulation of a person rather than direct technical compromise.
- Recognise how checking spelling, tone and URLs can expose deception.
- Distinguish closely related threats in examination scenarios.
Key Terms
- Pharming
- Redirecting a user to a fraudulent website even when the user attempts to use a genuine address.
- Phishing
- Using a fraudulent communication to deceive a user into revealing information or following a harmful link.
- Social engineering
- Manipulating a person into revealing information or performing an action that weakens security.
- Fraudulent website
- A false site designed to imitate or misrepresent a genuine service.
- Spoofed communication
- A message made to appear as if it came from a trusted source.
- Urgency
- Pressure that encourages a user to act before carefully checking.
- Tone
- The style and manner of a message, which may reveal that it is unusual or fraudulent.
- Link destination
- The actual URL opened by a hyperlink, which may differ from the displayed text.
Phishing
Phishing uses a fraudulent message to deceive a user. The message may imitate a bank, school, service provider or colleague. It commonly asks the user to enter login details, disclose personal information or select a link.
The aim is often to steal credentials or other sensitive data. The attacker relies on the user trusting the message and acting voluntarily.
Warning signs can include unusual spelling, an unexpected tone, pressure to act urgently, a request for confidential information or a link whose actual destination does not match the claimed organisation.
Pharming
Pharming redirects a user to a fraudulent website even when the user believes a genuine address has been used. The false site may closely imitate the real site and ask for login or financial details.
Unlike a typical phishing attack, pharming does not depend on the user selecting a deceptive message link. The redirection process causes the user to arrive at the false destination.
The aim is commonly to collect sensitive information entered into the fraudulent site. Checking the final domain and protected connection remains important, although a convincing imitation may still deceive the user.
Social Engineering
Social engineering is the broader manipulation of people to weaken security. An attacker may pretend to be technical support, a manager or another trusted person. The attacker creates trust, fear, urgency or curiosity so that the victim reveals information or performs an unsafe action.
Phishing is a form of social engineering because it manipulates the recipient through a message. Social engineering can also occur through a telephone call, face-to-face conversation or other communication.
The key is that the attacker targets human decision-making. The person is persuaded to bypass controls that the technical system cannot fully enforce.
Checking Communications
The syllabus explicitly includes checking the spelling and tone of communications. Poor spelling can indicate an unprofessional fraudulent message, while an unusual tone or unexpected urgency can indicate impersonation. These signs do not prove fraud, but they provide reasons to verify the message independently.
The URL attached to a link should be inspected before it is opened. The displayed link text can be different from the actual destination. Users should verify the domain rather than trusting a familiar logo or page design.
Responding Safely
A user should not disclose credentials in response to an unexpected message. The claimed organisation can be contacted through a known genuine route rather than through the supplied link or contact details.
Authentication and privacy settings reduce some consequences, but awareness is essential because social engineering aims to persuade an authorised user to cooperate with the attacker.
Comparing Deception Threats
| Threat | Core Process | Typical User Experience |
|---|---|---|
| Phishing | Fraudulent communication requests information or directs the user to a false page | User receives a deceptive email, message or similar communication |
| Pharming | User is redirected to a fraudulent website | User may enter a genuine-looking address but reaches a false destination |
| Social engineering | Attacker manipulates a person into revealing information or performing an unsafe action | User is pressured, persuaded or impersonated through any communication method |
Worked Examples
Identifying Phishing
Question: A message claims an account will close in ten minutes unless the user selects a link and enters a password. Identify two warning signs and the threat.
- Identify pressure or urgency.
- Identify the request to follow a link and reveal a password.
- Classify the fraudulent message.
Answer: The urgency and request for credentials through a supplied link are warning signs. The threat is phishing and also uses social engineering.
Phishing Or Pharming
Question: A user types the usual bank address but is silently redirected to an imitation site. Which threat is described?
- Notice that the user did not rely on a deceptive message link.
- Identify redirection to a fraudulent website.
Answer: Pharming is described.
Examination Guidance
- Use communication deception for phishing and redirection for pharming.
- For social engineering, explain the manipulation of a person.
- When advising a user, mention checking spelling, tone and the actual URL.
- Do not rely only on page appearance; fraudulent pages can imitate genuine designs.
Common Mistakes
- Calling every misleading message pharming.
- Saying social engineering is a software program.
- Checking only the displayed hyperlink text rather than the destination URL.
- Assuming good spelling guarantees that a message is genuine.
Knowledge Check
1. What is phishing?
2. What is pharming?
3. What is social engineering?
4. Name two communication features that should be checked.
5. Why should the URL attached to a link be checked?
