Lesson 11 — Beginner

Social Engineering (Phishing, Pretexting)

Duniya ke sabse bade breaches mein technical flaw nahi, insaan ka bharosa toda gaya. Is lesson mein hum social engineering ke type (phishing family se pretexting tak), uske psychology principles aur red flags ka checklist samjhenge — ye skill roz kaam aati hai.

⏱ 13 min• Beginner• Wireless Security

Social engineering kya hai

WHAT

Social engineering = insaan ko manipulate karke information ya access churaana. Technology nahi, PSYCHOLOGY ka attack hai — trust, urgency, fear use karke.

WHEN

Fake call, SMS, email, WhatsApp message, ya seedha office gate pe aake — har jagah. Festival, sale aur tax-declaration ke around spike hota hai.

WHERE

Phone (vishing), SMS, email, LinkedIn/DMs, ATM/office premises — jahan insaan ho, wahan social engineering mumkin hai.

Ek line: phishing mein target code nahi, insaan hota hai. Isliye iska defense bhi technical nahi — awareness + verification habit hai.

Phishing family ke type

Phishing     : bulk fake email/message (jaise bank jaisa)
Spear ph.    : TARGETED — naam, company jaan ke bheja
Whaling      : bade targets (CEO/CFO) — fake payment orders
Smishing     : SMS/WhatsApp se aaya link
Vishing      : phone call se (voice) — ab AI voice cloning bhi
Pharming     : DNS tamper -> sahi URL pe bhi fake site dikhe
Clone ph.    : asli email clone karke usme reply add kar diya
Cat phishing : social media DM se contact badha ke trust banaya

India mein trend : Smishing + Vishing sabse zyada active

Yaad rakho: Spear phishing isliye zyada khatarnaak hai kyunki wo personal detail use karta hai — naam, company, designation likha hota hai. Generic spam se zyada bharosa dilata hai.

Doosre techniques aur psychology

Pretexting: nakli story bana ke info maangna (auditor, HR, bank wala).
Baiting: lalch — free pen drive, free movie download link.
Tailgating: authorized band ke peeche chupke se andar ghusna.
Quid pro quo: "help karunga, badle mein access chahiye".
Shoulder surfing: dekh ke password/PIN note karna.
CEO fraud: boss ka nakli email — "jaldi payment kar do".

Psychology triggers jo har attacker use karta hai: urgency (24 ghante mein band), authority (CEO/CUR/allotment office), fear (account block), greed (jeet gaye), curiosity. Inme se ek dikhe toh ruk jao.

Red flags aur bachao ka checklist

RED FLAGS (dekhte hi suspect karo):
  - Sender address check (bank se aaya par gmail.com?)
  - Urgency/fear language — "24 ghante mein band ho jaayega"
  - Link pe hover -> domain check (typo jaise microsofft)
  - Unexpected OTP/PIN/CVV/payment maangna
  - Attachments jinka tumne maanga hi nahi
  - Offer jaisa kuch — "1 crore jeet gaye"

BACHAO (golden rules):
  1. Message ke number/URL se nahi — official website/app se verify
  2. OTP/PIN/CVV kisi ko kabhi nahi (bank kabhi nahi maangta)
  3. RUK socho -> verify karo -> phir act
  4. Report: office IT ko, ya cybercrime.gov.in + 1930
  5. Click ho gaya toh password badlo + device scan

Sabse strong defense ek habit hai: verify through a second channel. KYC wale ne call kiya? Company ki official site se khud number nikal ke confirm karo — message wale number pe nahi.

Exercise

Question: SMS/WhatsApp ke through aaye phishing ko kya kehte hain? (smishing/vishing/pharming)

Question: CEO ko target karke kiya gaya phishing attack kya kehlata hai? (whaling/spear)

Question: Bank kabhi customer se OTP maangta hai — sahi ya galat? (sahi/galat)

Common mistakes

Phishing ko sirf email samajhna: SMS (smishing), call (vishing), WhatsApp — sab phishing ke raaste hain. Channel badalta hai, trick same rehti hai.
Sochna "mujhe nahi phasayenge": Padhe-likhe log bhi phish hote hain — attacker urgency aur authority use karta hai. Overconfidence hi sabse bada risk hai.
Message ke diye number pe hi verify kar lena: Wo number toh attacker ka hai. Hamesha official website/app se khud number nikalo — second channel se confirm karo.

Desi example: KYC update wala call

Call aayi — "Aapka bank KYC update pending hai, warna account block. Ye link bhej raha hoon, OTP batana." Ye India ka #1 fraud pattern hai. Rokne ka simple rule:

Call : KYC pending + link + OTP maangna
STOP : bank kabhi OTP nahi maangta
Do   : call cut, bank app/official number pe check
Report: 1930 + cybercrime.gov.in (der mat karo)

Exam mapping (CUET / TCS / Cert)

CUET: phishing ke type (smishing, vishing) direct question.
TCS NQT: "What is phishing?" + prevention.
Security+ : social engineering ke principles ke naam.
Trap: "Only uneducated people fall for phishing" — galat, koi bhi urgency mein galti kar sakta hai.

Lesson complete?

Social engineering se bachna aa gaya. Agla lesson — Security Tools — mein dekhenge Nmap, Wireshark aur Kali kya hain aur legit use kya hai.