Computing · Secondary 4

Active learning ideas

Social Engineering and Phishing

Active learning fits this topic because phishing and social engineering rely on human reactions rather than technical knowledge. Students need practice recognizing manipulation to move from awareness to action, and role-plays or simulations make abstract tactics concrete and memorable.

• MOE Syllabus Outcomes
• MOE: Cybersecurity - S4
• MOE: Cyber Threats - S4

• 25–50 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Role Play
• 30 min · Pairs

Role-Play: Phishing Encounters

Pair students as attacker and defender. Attacker crafts and delivers a phishing script via email or call; defender practices verification steps like checking URLs and pausing before clicking. Switch roles, then discuss tactics in pairs.

Why is the human element often the weakest link in cybersecurity?

Facilitation Tip

During the Role-Play, assign clear character roles (e.g., attacker, victim, observer) and give each observer a specific red-flag checklist to guide feedback.

What to look for

Provide students with a sample phishing email. Ask them to identify at least three red flags in the email and explain why each is a warning sign. Collect these as students leave the class.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Role Play
• 40 min · Small Groups

Small Group: Email Dissection

Provide real and fake phishing emails. Groups annotate red flags such as poor grammar, urgent language, and suspicious links. Present findings to class with evidence from psychological principles.

Analyze the psychological tactics used in social engineering attacks.

Facilitation Tip

For Email Dissection, provide printed emails with line numbers so students can annotate and reference details without guesswork.

What to look for

Pose the question: 'Why do you think people fall for social engineering scams even when they know about them?' Facilitate a class discussion, encouraging students to share their thoughts on psychological factors and the pressure of urgency.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 03

• Role Play
• 50 min · Small Groups

Campaign Workshop: Peer Posters

In small groups, design posters or short videos for a school phishing awareness campaign. Include examples, tactics, and prevention tips. Groups pitch to class for feedback and vote on best elements.

Design a public awareness campaign to educate peers about phishing scams.

Facilitation Tip

In the Campaign Workshop, limit poster space to force prioritization of the most critical warning signs.

What to look for

Present students with short scenarios describing potential social engineering attempts (e.g., a phone call asking for personal details, a tempting pop-up ad). Ask students to quickly write down the type of attack and one immediate action they should take.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 04

• Simulation Game
• 25 min · Whole Class

Simulation Game: Baiting Defense

Hide 'bait' USBs with safe demos around class. Students find, evaluate risks, and report without plugging in. Debrief on physical social engineering cues like unexpected finds.

Why is the human element often the weakest link in cybersecurity?

Facilitation Tip

During Simulation Game, use a timer to create urgency and observe whether students verify details before acting.

What to look for

Provide students with a sample phishing email. Ask them to identify at least three red flags in the email and explain why each is a warning sign. Collect these as students leave the class.

• Apply
• Analyze
• Evaluate
• Create
• Social Awareness
• Decision-Making

A few notes on teaching this unit

Experienced teachers approach this topic by normalizing mistakes and framing vulnerability as universal, not personal. They use short, repeated practice to build hesitation into decision-making and avoid overwhelming students with technical jargon. Research shows that students who rehearse responses in low-stakes settings are more likely to pause when real pressure hits.

Successful learning looks like students applying red flags to new situations, stepping back before acting under pressure, and articulating why psychological triggers work. They should leave able to explain tactics to peers and family, showing understanding beyond the classroom.

---

Watch Out for These Misconceptions

• During the Simulation Game, watch for students who believe antivirus software blocks all phishing attempts.

  Use the game’s debrief to contrast technical defenses with behavioral ones; have students explain why hesitation and verification are still needed even with antivirus.

• During group discussions in the Campaign Workshop, watch for students who think only careless or greedy people fall for social engineering.

  Ask groups to share personal anecdotes during the workshop’s peer review, then highlight how authority bias or urgency affects everyone, using their examples as evidence.

• During the Role-Play, watch for students who assume social engineering only happens online.

  Introduce physical props like fake USB drives or scripted calls during the role-play, then ask students to identify tactics that work across digital and physical spaces.

---

Methods used in this brief

• Role Play
• Simulation Game