Computing · Secondary 3 · Cybersecurity and Defense · Semester 2

Phishing and Social Engineering

Students will investigate social engineering tactics, particularly phishing, and learn to identify and avoid them.

• MOE Syllabus Outcomes
• MOE: Cybersecurity - S3

About This Topic

Phishing and social engineering form a core part of the Secondary 3 Cybersecurity and Defense unit in the MOE Computing curriculum. Students investigate tactics attackers use to exploit psychological principles such as authority, urgency, reciprocity, and familiarity. They examine real examples of phishing emails, smishing texts, and vishing calls, learning to spot red flags like unexpected requests for credentials, suspicious URLs, mismatched sender details, and pressure to act quickly. Key skills include differentiating legitimate communications from fakes and designing personal strategies, such as verifying sources through official channels and enabling two-factor authentication.

This topic aligns with MOE cybersecurity standards, building digital literacy and ethical habits for Singapore's connected environment. It addresses key questions on psychological manipulation and defense, preparing students for everyday threats on platforms they use daily, from email to social media.

Active learning benefits this topic greatly because students apply concepts through simulations and role-plays. Dissecting mock attacks in groups or practicing responses builds pattern recognition and confidence. These methods turn theoretical knowledge into instinctive behaviors, with peer discussions reinforcing collective vigilance and long-term retention.

Key Questions

1. Analyze the psychological principles exploited by social engineering attacks.
2. Differentiate between legitimate communications and phishing attempts.
3. Design strategies to protect oneself from social engineering tactics.

Learning Objectives

• Analyze the psychological triggers, such as urgency and authority, exploited in social engineering attacks.
• Differentiate between legitimate digital communications and phishing attempts by identifying specific red flags.
• Design a personal defense strategy incorporating at least three distinct methods to mitigate social engineering risks.
• Evaluate the effectiveness of various social engineering tactics by comparing their common characteristics and impacts.
• Critique real-world examples of phishing scams, explaining how they target user vulnerabilities.

Before You Start

Introduction to Cybersecurity

Why: Students need a foundational understanding of what cybersecurity is and why protecting digital information is important before exploring specific threats like phishing.

Digital Citizenship and Online Safety

Why: Prior knowledge of responsible online behavior and awareness of general online risks prepares students to understand the malicious intent behind social engineering tactics.

Key Vocabulary

Phishing	A type of social engineering attack where attackers impersonate legitimate entities to trick individuals into revealing sensitive information like passwords or credit card details.
Social Engineering	The psychological manipulation of people into performing actions or divulging confidential information, often used as a precursor to cyberattacks.
Spear Phishing	A targeted phishing attack that is customized for a specific individual or organization, making it more convincing and harder to detect.
Vishing	Voice phishing, a type of social engineering that uses phone calls to deceive individuals into providing personal information or transferring money.
Smishing	SMS phishing, a fraudulent attempt to obtain sensitive information such as usernames, passwords, and credit card details by disguising oneself as a trustworthy entity in a text message.

Watch Out for These Misconceptions

Common Misconception

Phishing always has obvious errors like bad spelling.

What to Teach Instead

Advanced phishing uses perfect grammar and branding to mimic trusted sources. Group analysis of varied examples in stations helps students spot subtle cues like domain mismatches, building nuanced detection skills through comparison.

Common Misconception

I am safe if I do not click links.

What to Teach Instead

Phishing can succeed through data entry or downloads alone; even hovering over links reveals risks. Role-play drills demonstrate full attack chains, allowing students to practice complete avoidance strategies in safe settings.

Common Misconception

Social engineering only targets careless people.

What to Teach Instead

Everyone faces tailored attacks exploiting universal biases. Peer discussions during quizzes reveal personal vulnerabilities, fostering empathy and collaborative strategy development.

Active Learning Ideas

Stations Rotation: Phishing Analysis Stations

Prepare four stations with printed phishing emails, fake websites on laptops, smishing texts, and vishing scripts. Small groups spend 8 minutes per station identifying red flags, such as urgent language or bad links, and recording evidence on worksheets. Groups rotate and share findings in a debrief.

40 min·Small Groups

Role-Play: Social Engineering Drills

Assign pairs one attacker and one victim using scenario cards based on real tactics like pretexting or baiting. The 'victim' responds while class observes tactics. Switch roles, then discuss defenses as a whole class.

30 min·Pairs

Design Challenge: Defense Posters

In small groups, students create infographics or posters outlining phishing red flags and protection steps, using tools like Canva. Incorporate psychological principles with visuals. Groups present to class for feedback.

45 min·Small Groups

Quiz Game: Spot the Phish

Project sample messages or sites; teams buzz in to classify as legit or phishing and explain why. Award points for correct analysis of elements like sender and attachments. Review answers together.

25 min·Whole Class

Real-World Connections

• Financial institutions like DBS Bank regularly issue public service announcements and security alerts to educate customers about common phishing scams targeting bank account credentials and transaction approvals.
• Government agencies, such as Singapore's Cyber Security Agency (CSA), provide online resources and advisories detailing current cyber threats, including phishing campaigns that impersonate official communications to solicit personal data.
• E-commerce platforms like Lazada and Shopee warn users about fake login pages and fraudulent offers designed to steal account information or trick customers into making payments to unofficial channels.

Assessment Ideas

Exit Ticket

Present students with two sample emails, one legitimate and one phishing attempt. Ask them to identify three specific red flags in the phishing email and explain why each is a concern. They should also state one action they would take if they received the phishing email.

Discussion Prompt

Pose the question: 'Why are people, rather than technology, often the weakest link in cybersecurity?' Facilitate a class discussion where students share examples of social engineering tactics and explain the psychological principles that make them effective.

Quick Check

Show a short video clip depicting a vishing or smishing scenario. Ask students to write down on a sticky note the primary goal of the attacker and one question they would ask to verify the caller's identity or the legitimacy of the request.

Frequently Asked Questions

How do I teach students to spot phishing emails?

Focus on red flags like unsolicited requests, urgency, and sender inconsistencies. Use real anonymized examples for dissection: check headers, hover over links, verify via official sites. Follow with practice quizzes where students justify classifications. This builds analytical habits over rote memorization, with 80% of students improving recognition after repeated exposure.

What are common social engineering tactics in schools?

Tactics include phishing via email or apps pretending to be teachers, smishing from 'friends' sharing malware, and pretexting calls requesting login details. Stress psychological hooks like authority from school domains or scarcity in 'limited-time' offers. Classroom simulations reveal how familiarity lowers guards, prompting verification routines.

How can active learning help students understand phishing?

Active methods like role-plays and station rotations immerse students in attack scenarios, making tactics memorable. They practice spotting fakes collaboratively, discuss reactions, and refine defenses iteratively. This outperforms lectures: students retain 75% more when applying concepts hands-on, gaining confidence to handle real threats independently.

What strategies protect against social engineering?

Teach verification: contact sources directly, never reply to suspects. Enable MFA, use password managers, and report incidents. Design class pledges for habits like pausing under pressure. Simulations reinforce these, with students creating personalized plans shared in groups for peer accountability and reinforcement.

From the Blog

Restorative Justice in Schools: A Complete Guide to Implementation and Impact

Restorative justice in schools reduces suspensions and builds school climate. Learn to implement it, compare it to PBIS, and get classroom-ready scripts.