How it works
Attackers often target trust, urgency, fear, helpfulness, or routine habits. Phishing, pretexting, baiting, and impersonation work because people are part of every system.
The best defense usually combines verification, reporting, training, and authentication controls rather than telling users to simply be careful.
Common error
If an answer asks a user to share a password, one-time code, or reset link, it is almost always unsafe.
Worked example
A message claims to be the principal and demands an urgent payment-code screenshot. Choose a trusted response.
Evidence
Pressure: immediate action
Requested secret: payment verification code
Contact method: unfamiliar message accountDo not send the code or use the message contact details to verify the request. Contact the principal through an independently known channel and report the message through the approved process. Preserve the message for investigation without spreading sensitive content.
Exercises
1.2.1
Why does a familiar display name not establish that a message came from a trusted staff member?
Show solution
Display names can be copied or forged. Verify unusual requests through a separately established contact method and inspect relevant message evidence.
1.2.2
Propose a workflow control stronger than a reminder to be careful for urgent payment requests.
Show solution
Require independent confirmation and a second authorized approval before payment changes or transfers. Document exceptions and give staff a clear reporting path.