Social Engineering Attacks

Active learning works for social engineering because manipulation relies on human behavior, not just technical facts. Students need to experience the emotional triggers and social pressures attackers use to truly recognize risks.

• Year 9
• Technologies
• 4 activities
• 30 min–45 min

Learning Objectives

1. Analyze the psychological triggers, such as authority and scarcity, exploited by social engineers.
2. Design a set of questions to verify the legitimacy of an unexpected or urgent request.
3. Evaluate the effectiveness of different security awareness training methods in preventing phishing attacks.
4. Identify common social engineering tactics used in phishing emails and pretexting scenarios.
5. Critique real-world examples of social engineering breaches, explaining the human vulnerabilities exploited.

Role Play

⏱ 35 min·Pairs

Role-Play: Phishing Scenarios

Provide scripts for common phishing attacks. Pairs alternate as attacker and target, practicing responses like checking URLs or pausing to verify. Debrief as a class to share effective counters.

Prepare & details

Analyze the psychological principles exploited in social engineering attacks.

Facilitation Tip: In the role-play, assign clear roles (attacker, victim, witness) and rotate observers to note body language and urgency tactics.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Case Study Analysis

⏱ 45 min·Small Groups

Case Study Analysis: Real Attacks

Distribute summaries of attacks like the Twitter Bitcoin scam. Small groups identify exploited principles, note failures in defenses, and propose improvements. Groups present findings.

Prepare & details

Design strategies to identify and resist common social engineering tactics.

Facilitation Tip: For case studies, assign small groups one attack to analyze, then have them present the psychological triggers and organizational failures.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Role Play

⏱ 40 min·Small Groups

Strategy Design: Defense Posters

Small groups research one tactic, such as baiting, then design posters with warning signs and resistance steps. Display posters and vote on the most persuasive.

Prepare & details

Evaluate the effectiveness of security awareness training in mitigating social engineering risks.

Facilitation Tip: When designing defense posters, require students to include a slogan, visual cue, and step-by-step response to show deep understanding.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Formal Debate

⏱ 30 min·Whole Class

Formal Debate: Training Effectiveness

Divide class into teams to argue for or against specific awareness training methods. Use evidence from studies. Vote and reflect on key insights.

Prepare & details

Analyze the psychological principles exploited in social engineering attacks.

Facilitation Tip: During the debate, give teams 10 minutes to prepare points using evidence from the case studies or their own experiences.

Setup: Two teams facing each other, audience seating for the rest

Materials: Debate proposition card, Research brief for each side, Judging rubric for audience, Timer

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Teaching This Topic

Teachers should create a safe space for students to share mistakes or close calls without judgment. Research shows that discussing real experiences builds empathy and retention more than abstract lessons. Avoid lecturing about dangers; instead, let students discover vulnerabilities through simulations and peer feedback.

What to Expect

Successful learning looks like students confidently identifying manipulation tactics, explaining why they work, and applying defenses in real-world contexts. They should discuss vulnerabilities openly and design clear, actionable strategies.

Watch Out for These Misconceptions

Common Misconception

During the Role-Play: Phishing Scenarios activity, watch for students assuming social engineering only happens online.

What to Teach Instead

Use the role-play to act out both digital and physical attacks, such as tailgating or shoulder surfing, so students see how tactics cross contexts.

Common Misconception

During the Case Study Analysis: Real Attacks activity, watch for students believing only tech-savvy people avoid traps.

What to Teach Instead

Have students share personal anecdotes or 'close calls' during the discussion to reveal how psychological triggers affect everyone.

Common Misconception

During the Strategy Design: Defense Posters activity, watch for students assuming antivirus software handles human risks.

What to Teach Instead

Challenge groups to design defenses that go beyond tech, such as verification steps or peer review protocols, and peer-review each design for completeness.

Assessment Ideas

Quick Check

After the Role-Play: Phishing Scenarios activity, present students with three short scenarios and ask them to identify the tactic and explain the risk in 1-2 sentences per scenario.

Discussion Prompt

During the Debate: Training Effectiveness activity, facilitate a class discussion using the prompt: 'Imagine you receive an email from your school principal asking you to immediately send them a list of all student passwords for an urgent audit. What steps would you take to verify this request, and why are these steps important?' Collect responses to assess understanding of verification processes.

Exit Ticket

After the Strategy Design: Defense Posters activity, ask students to list two common social engineering tactics and one specific strategy to protect themselves or others from each tactic on an index card.

Extensions & Scaffolding

• Challenge: Ask early finishers to create a social media post warning peers about a specific tactic, using hashtags and memes to boost engagement.
• Scaffolding: Provide sentence starters for students struggling to articulate defenses, such as 'This is likely a phishing attempt because...'
• Deeper exploration: Explore cultural differences in social norms that attackers exploit, such as gift-giving customs or respect for authority figures.

Key Vocabulary

Phishing	An attack where individuals are tricked into revealing sensitive information, such as passwords or credit card numbers, often through deceptive emails or websites.
Pretexting	A social engineering tactic where an attacker creates a fabricated scenario or 'pretext' to gain trust and extract information from a victim.
Baiting	An attack that lures victims into a trap by offering something enticing, like a free download or a USB drive left in a public place, which contains malware.
Social Proof	A psychological phenomenon where people assume the actions of others in an attempt to reflect correct behavior, often exploited by attackers to create a sense of normalcy or urgency.
Urgency	A tactic used by social engineers to pressure individuals into acting quickly without thinking, often by claiming a limited-time offer or an immediate threat.