Phishing and Social Engineering

Students retain cybersecurity skills best when they practice in controlled, realistic settings. Phishing and social engineering tactics rely on human psychology, so active role-play and analysis help students recognize patterns and build habits before facing real threats. These activities make abstract concepts concrete by letting students see, test, and refine their strategies.

• Secondary 3
• Computing
• 4 activities
• 25 min–45 min

Learning Objectives

1. Analyze the psychological triggers, such as urgency and authority, exploited in social engineering attacks.
2. Differentiate between legitimate digital communications and phishing attempts by identifying specific red flags.
3. Design a personal defense strategy incorporating at least three distinct methods to mitigate social engineering risks.
4. Evaluate the effectiveness of various social engineering tactics by comparing their common characteristics and impacts.
5. Critique real-world examples of phishing scams, explaining how they target user vulnerabilities.

Stations Rotation

⏱ 40 min·Small Groups

Stations Rotation: Phishing Analysis Stations

Prepare four stations with printed phishing emails, fake websites on laptops, smishing texts, and vishing scripts. Small groups spend 8 minutes per station identifying red flags, such as urgent language or bad links, and recording evidence on worksheets. Groups rotate and share findings in a debrief.

Prepare & details

Analyze the psychological principles exploited by social engineering attacks.

Facilitation Tip: During Phishing Analysis Stations, circulate with a checklist to ensure each group records specific red flags and discusses why some messages appear legitimate.

Setup: Tables/desks arranged in 4-6 distinct stations around room

Materials: Station instruction cards, Different materials per station, Rotation timer

• Remember
• Understand
• Apply
• Analyze
• Self-Management
• Relationship Skills

Role Play

⏱ 30 min·Pairs

Role-Play: Social Engineering Drills

Assign pairs one attacker and one victim using scenario cards based on real tactics like pretexting or baiting. The 'victim' responds while class observes tactics. Switch roles, then discuss defenses as a whole class.

Prepare & details

Differentiate between legitimate communications and phishing attempts.

Facilitation Tip: In Social Engineering Drills, set a strict time limit to create urgency, just like real attackers do, while keeping the environment safe.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 45 min·Small Groups

Design Challenge: Defense Posters

In small groups, students create infographics or posters outlining phishing red flags and protection steps, using tools like Canva. Incorporate psychological principles with visuals. Groups present to class for feedback.

Prepare & details

Design strategies to protect oneself from social engineering tactics.

Facilitation Tip: For Defense Posters, provide colored markers and sticky notes so students can prototype ideas quickly and revise based on peer feedback.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 25 min·Whole Class

Quiz Game: Spot the Phish

Project sample messages or sites; teams buzz in to classify as legit or phishing and explain why. Award points for correct analysis of elements like sender and attachments. Review answers together.

Prepare & details

Analyze the psychological principles exploited by social engineering attacks.

Facilitation Tip: During Spot the Phish, use a timing device to build speed and accuracy, then debrief with examples of near-misses to reinforce learning.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Teaching This Topic

Teachers should start with basic phishing examples before advancing to sophisticated ones, because students need to master fundamentals before recognizing nuanced attacks. Avoid showing only extreme cases, as these create false confidence. Research shows that practicing with varied examples builds adaptable detection skills. Emphasize that social engineering targets everyone, not just careless users, so normalize mistakes and focus on recovery strategies.

What to Expect

Successful learning looks like students confidently identifying red flags in phishing attempts within seconds, explaining their reasoning, and choosing appropriate responses. They should also design clear, practical defenses and demonstrate empathy by recognizing how different social engineering tactics target varied personalities.

Watch Out for These Misconceptions

Common Misconception

During Phishing Analysis Stations, students may assume all phishing emails contain spelling errors.

What to Teach Instead

During Phishing Analysis Stations, provide examples of high-quality phishing with perfect grammar but subtle mismatches in domains or sender details, and guide students to compare logos, tone, and URLs to spot inconsistencies.

Common Misconception

During Social Engineering Drills, students may believe avoiding links is enough to stay safe.

What to Teach Instead

During Social Engineering Drills, set up scenarios where attackers request sensitive data without links, then debrief on full attack chains and complete avoidance strategies like verifying identities through official channels.

Common Misconception

During Spot the Phish, students may think social engineering only affects careless people.

What to Teach Instead

During Spot the Phish, include personalized examples showing how attackers exploit universal biases like urgency or authority, then facilitate peer discussions to reveal individual vulnerabilities and build collaborative defenses.

Assessment Ideas

Exit Ticket

After Phishing Analysis Stations, present two emails and ask students to identify three red flags in the phishing example, explain each concern, and state one action they would take if they received it.

Discussion Prompt

During Social Engineering Drills, pause after each scenario to ask students which psychological principle was used and why it might work on different personality types, then record their responses on a whiteboard.

Quick Check

During Spot the Phish, show a vishing or smishing clip and ask students to write the attacker's primary goal and one verification question on a sticky note, then collect and discuss responses as a class.

Extensions & Scaffolding

• Challenge students to create a phishing email that bypasses typical detection, then have peers analyze it in a gallery walk.
• For students who struggle, provide a side-by-side comparison of a legitimate and phishing email with guided questions to highlight differences.
• Allow extra time for students to research and share a recent real-world phishing case, explaining the tactics used and lessons learned.

Key Vocabulary

Phishing	A type of social engineering attack where attackers impersonate legitimate entities to trick individuals into revealing sensitive information like passwords or credit card details.
Social Engineering	The psychological manipulation of people into performing actions or divulging confidential information, often used as a precursor to cyberattacks.
Spear Phishing	A targeted phishing attack that is customized for a specific individual or organization, making it more convincing and harder to detect.
Vishing	Voice phishing, a type of social engineering that uses phone calls to deceive individuals into providing personal information or transferring money.
Smishing	SMS phishing, a fraudulent attempt to obtain sensitive information such as usernames, passwords, and credit card details by disguising oneself as a trustworthy entity in a text message.