Social Engineering and Phishing

Active learning works because social engineering relies on human responses, not just technical knowledge. Students need to practice spotting subtle cues in realistic contexts to build lasting vigilance. By analysing real-world examples and testing defences, they move from passive awareness to active scepticism for cybersecurity.

• Year 9
• Computing
• 4 activities
• 25 min–45 min

Learning Objectives

1. Analyze the psychological principles underlying common social engineering tactics like pretexting and baiting.
2. Critique sample phishing emails to identify specific indicators of malicious intent, such as urgent calls to action or requests for sensitive data.
3. Design a personal defense strategy incorporating at least three distinct methods to mitigate social engineering risks.
4. Compare and contrast the effectiveness of technical security measures versus human-factor defenses against cyber threats.

Role Play

⏱ 45 min·Small Groups

Email Critique Carousel

Print 6-8 sample emails, some phishing, some legitimate. Groups rotate every 7 minutes to analyse sender, content, links, and urgency. They vote and justify if phishing, then debrief as a class.

Prepare & details

Explain why social engineering is often considered the weakest link in cybersecurity.

Facilitation Tip: During the Email Critique Carousel, position students physically around the room so movement reinforces engagement with each example.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 30 min·Pairs

Phishing Role-Play Scenarios

Pairs draw scenario cards like 'boss emails urgent password request'. One acts as attacker, other as victim spotting tactics. Switch roles, then share strategies that worked.

Prepare & details

Critique a given email to determine if it is a phishing attempt.

Facilitation Tip: In Phishing Role-Play Scenarios, assign clear roles and rotate performers to ensure everyone practices both attacker and defender perspectives.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 40 min·Small Groups

Defence Strategy Design

In small groups, students brainstorm and poster personal protection plans covering email, calls, and public Wi-Fi. Include checklists and slogans. Present to class for feedback.

Prepare & details

Design strategies to protect oneself from common social engineering attacks.

Facilitation Tip: For Defence Strategy Design, provide blank templates with prompts to guide students from observation to actionable plans.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 25 min·Individual

Spot the Scam Hunt

Provide website screenshots or texts. Individually mark phishing indicators with highlighters, then pairs compare and create a class master list of clues.

Prepare & details

Explain why social engineering is often considered the weakest link in cybersecurity.

Facilitation Tip: During the Spot the Scam Hunt, use a timer to create urgency similar to real phishing attempts and observe how pressure affects decision-making.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Teaching This Topic

Teachers should model scepticism explicitly by questioning every detail in sample emails, not just pointing out errors. Research shows that students learn best when they experience the tension between trust and doubt in controlled simulations. Avoid treating social engineering as purely technical; focus on human psychology and context. Use humour and relatable scenarios to reduce fear while building critical habits.

What to Expect

Successful learning looks like students confidently identifying red flags in varied phishing attempts and articulating clear, personal strategies to verify requests. They should explain why human behaviour remains the primary vulnerability, even with technical protections. Observations and discussions reveal whether they transfer skills beyond the classroom.

Watch Out for These Misconceptions

Common Misconception

During Email Critique Carousel, watch for students assuming phishing emails always contain obvious spelling errors or bad design.

What to Teach Instead

Use the Email Critique Carousel to display varied examples, including sophisticated phishing that mimics legitimate sources closely. Guide students to notice subtle cues like mismatched domains or unexpected requests, and update their checklists to reflect nuanced detection beyond surface errors.

Common Misconception

During Phishing Role-Play Scenarios, watch for students believing social engineering only occurs online through emails.

What to Teach Instead

In Phishing Role-Play Scenarios, incorporate mediums like phone calls, USB drops, or in-person interactions. After each role-play, facilitate peer discussions to identify patterns across different methods, correcting the narrow view and building comprehensive awareness.

Common Misconception

During Defence Strategy Design, watch for students assuming antivirus software fully protects against social engineering.

What to Teach Instead

In Defence Strategy Design, present simulations where antivirus fails to catch phishing attempts. Ask students to critique these examples, emphasising behaviour over software. Their designed strategies should prioritise human vigilance as the primary defence.

Assessment Ideas

Quick Check

After Email Critique Carousel, present students with three anonymized email examples: one legitimate, one phishing, and one spear phishing. Ask them to label each and provide one specific reason for their classification for each email.

Discussion Prompt

After Phishing Role-Play Scenarios, facilitate a class discussion where students share examples of social engineering they encountered during the activity. Discuss the vulnerabilities exploited and why humans are often the weakest link in cybersecurity.

Peer Assessment

During Spot the Scam Hunt, have pairs swap scenarios and write down two specific questions they would ask to verify the caller’s identity and one action they would take to protect themselves based on the scenario they reviewed.

Extensions & Scaffolding

• Challenge early finishers to create a phishing email that bypasses common school filters, then swap and critique each other’s work.
• Scaffolding: Provide a checklist with three red flags for students to reference during the Email Critique Carousel if they struggle.
• Deeper: Invite a cybersecurity professional to share a real phishing case study and analyse the tactics used in class.

Key Vocabulary

Social Engineering	The art of manipulating people into performing actions or divulging confidential information, often exploiting psychological biases.
Phishing	A type of social engineering attack where attackers impersonate legitimate entities via electronic communication, usually email, to trick individuals into revealing sensitive data or installing malware.
Pretexting	A social engineering tactic where an attacker creates a fabricated scenario, or pretext, to gain trust and obtain information from a victim.
Baiting	A social engineering tactic that lures victims into a trap by offering something enticing, such as a free download or a physical infected USB drive.
Spear Phishing	A targeted phishing attack that is customized to a specific individual or organization, making it more convincing and harder to detect.