Social Engineering and Phishing

Active learning fits this topic because phishing and social engineering rely on human reactions rather than technical knowledge. Students need practice recognizing manipulation to move from awareness to action, and role-plays or simulations make abstract tactics concrete and memorable.

• Secondary 4
• Computing
• 4 activities
• 25 min–50 min

Learning Objectives

1. Analyze the psychological tactics, such as urgency and authority, employed in social engineering attacks like phishing and pretexting.
2. Evaluate the effectiveness of different defense mechanisms against common phishing and baiting techniques.
3. Design a public awareness campaign poster that clearly explains one type of social engineering attack and provides actionable advice for prevention.
4. Identify the common red flags present in deceptive emails, messages, or websites used in social engineering scams.

Role Play

⏱ 30 min·Pairs

Role-Play: Phishing Encounters

Pair students as attacker and defender. Attacker crafts and delivers a phishing script via email or call; defender practices verification steps like checking URLs and pausing before clicking. Switch roles, then discuss tactics in pairs.

Prepare & details

Why is the human element often the weakest link in cybersecurity?

Facilitation Tip: During the Role-Play, assign clear character roles (e.g., attacker, victim, observer) and give each observer a specific red-flag checklist to guide feedback.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 40 min·Small Groups

Small Group: Email Dissection

Provide real and fake phishing emails. Groups annotate red flags such as poor grammar, urgent language, and suspicious links. Present findings to class with evidence from psychological principles.

Prepare & details

Analyze the psychological tactics used in social engineering attacks.

Facilitation Tip: For Email Dissection, provide printed emails with line numbers so students can annotate and reference details without guesswork.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 50 min·Small Groups

Campaign Workshop: Peer Posters

In small groups, design posters or short videos for a school phishing awareness campaign. Include examples, tactics, and prevention tips. Groups pitch to class for feedback and vote on best elements.

Prepare & details

Design a public awareness campaign to educate peers about phishing scams.

Facilitation Tip: In the Campaign Workshop, limit poster space to force prioritization of the most critical warning signs.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Simulation Game

⏱ 25 min·Whole Class

Simulation Game: Baiting Defense

Hide 'bait' USBs with safe demos around class. Students find, evaluate risks, and report without plugging in. Debrief on physical social engineering cues like unexpected finds.

Prepare & details

Why is the human element often the weakest link in cybersecurity?

Facilitation Tip: During Simulation Game, use a timer to create urgency and observe whether students verify details before acting.

Setup: Flexible space for group stations

Materials: Role cards with goals/resources, Game currency or tokens, Round tracker

• Apply
• Analyze
• Evaluate
• Create
• Social Awareness
• Decision-Making

Teaching This Topic

Experienced teachers approach this topic by normalizing mistakes and framing vulnerability as universal, not personal. They use short, repeated practice to build hesitation into decision-making and avoid overwhelming students with technical jargon. Research shows that students who rehearse responses in low-stakes settings are more likely to pause when real pressure hits.

What to Expect

Successful learning looks like students applying red flags to new situations, stepping back before acting under pressure, and articulating why psychological triggers work. They should leave able to explain tactics to peers and family, showing understanding beyond the classroom.

Watch Out for These Misconceptions

Common Misconception

During the Simulation Game, watch for students who believe antivirus software blocks all phishing attempts.

What to Teach Instead

Use the game’s debrief to contrast technical defenses with behavioral ones; have students explain why hesitation and verification are still needed even with antivirus.

Common Misconception

During group discussions in the Campaign Workshop, watch for students who think only careless or greedy people fall for social engineering.

What to Teach Instead

Ask groups to share personal anecdotes during the workshop’s peer review, then highlight how authority bias or urgency affects everyone, using their examples as evidence.

Common Misconception

During the Role-Play, watch for students who assume social engineering only happens online.

What to Teach Instead

Introduce physical props like fake USB drives or scripted calls during the role-play, then ask students to identify tactics that work across digital and physical spaces.

Assessment Ideas

Exit Ticket

After Email Dissection, provide a new phishing email and ask students to identify three red flags and explain why each is a warning sign. Collect their responses as they leave to check for transfer of skills.

Discussion Prompt

During the Campaign Workshop, facilitate a group discussion asking: 'Why do people fall for social engineering even when they know the risks?' Use their poster examples to anchor responses about psychological pressure and familiarity.

Quick Check

After Simulation Game, present three short scenarios (e.g., a call from 'IT support,' a pop-up claiming a virus, a USB left in the hallway) and have students write the type of attack and one action they would take before moving to the next scenario.

Extensions & Scaffolding

• Challenge students finishing early to design a phishing email that bypasses their own classmates' red flags, then test it in a follow-up session.
• Scaffolding for struggling students include a step-by-step guide for dissecting emails, highlighting sender addresses, links, and urgency language.
• Deeper exploration: Have students research a real-world social engineering case, map the tactics used, and present to the class.

Key Vocabulary

Phishing	A cyberattack where attackers impersonate legitimate organizations or individuals via email, text, or websites to trick victims into revealing sensitive information or clicking malicious links.
Pretexting	A social engineering technique where an attacker creates a fabricated scenario or 'pretext' to gain trust and extract information from a victim, often by impersonating someone in authority.
Baiting	A social engineering tactic that lures victims into a trap by offering something enticing, like a free download or a seemingly harmless USB drive, which then delivers malware.
Social Proof	A psychological manipulation tactic where attackers claim many others are already using a service or have fallen for a scam to encourage conformity and reduce critical thinking.