Phishing & social engineering

Phishing is a message, usually email or text, that pretends to be from someone you trust in order to make you do something: click a link, enter a password, approve a payment, open an attachment. The technology behind it is simple. The skill is in the psychology, which is why it is called social engineering.

Almost every phishing message leans on the same levers: urgency ("your account will be closed in 24 hours"), authority ("this is the IT department"), fear ("suspicious sign-in detected"), or reward ("you have a refund waiting"). The goal is to make you act before you think. Well-crafted phishing now looks polished, uses correct logos and can even reference real recent events, so "it looks professional" is no longer a sign of safety.

The most reliable defence is not spotting typos. It is a habit: never act on a link or phone number inside an unexpected message. Instead, go to the service the way you normally would, through your bookmark or the app, and check there. If the problem is real, it will be waiting for you.