CyberConflux · Program Session

How Cybercriminals Exploit Human Psychology: Understanding Social Engineering & Phishing Attacks

Archived June 01, 2026 ▶ Recording Available 📝 Notes Included

Session Recording

Session Notes

Interactive Session

This session includes a live Q&A and open audience discussion. Come prepared with questions about:

Real incidents you’ve encountered or heard about
Specific phishing techniques you want to understand better
How to build security awareness culture in your organization
Tools and resources for ongoing protection

Session Duration: 1 Hour + Q&A

Hosted by Macaulay Esene — CyberConflux Admin

Session Overview

This workshop analyzed how cybercriminals exploit human psychology rather than technical vulnerabilities to gain unauthorized access. The central theme: humans are the weakest link in security — not because people are foolish, but because attackers are deliberately designed to bypass rational thinking by triggering emotional responses.

“Modern cyber attacks don’t begin with malware or advanced hacking tools. They begin with people — because technology is often harder to bypass than human behavior.” — Macaulay Esene

Social engineering is the psychological manipulation of people into performing actions or revealing confidential information — without them realizing they’ve been exploited.

Unlike traditional hacking that targets systems, social engineering targets people. It is almost always easier to convince a human to open a door or hand over credentials than it is to break through a firewall.

Why It Works

Attackers exploit the fact that humans are emotional and predictable. The key psychological triggers exploited include:

Trigger	How It’s Used
Trust	Impersonating Microsoft, Google, or your bank
Fear	”Your account will be suspended in 30 minutes”
Urgency	Forcing fast decisions to bypass critical thinking
Curiosity	”You’ve been mentioned in this document — click to view”
Greed	Fake prize notifications, gift card offers
Authority	CEO impersonation requesting urgent wire transfers

The combination of fear + urgency is particularly effective — it prevents the target from pausing to verify the request.

📖 Further Reading: OWASP Social Engineering Attacks

2. Phishing — The Most Common Attack Vector

Phishing is a cyberattack where criminals impersonate trusted entities to steal credentials, banking information, or corporate access. It combines technology (to deliver the message) with psychology (to manipulate the recipient).

Types of Phishing

Type	Description
Email Phishing	Mass emails impersonating trusted brands
Spear Phishing	Targeted attack on a specific individual using personal details
Smishing	SMS-based phishing (“Your bank account has been restricted”)
Vishing	Voice/phone-based phishing — attacker calls pretending to be IT support, bank, or government

📖 Further Reading: CISA Phishing Guidance

3. Anatomy of a Phishing Email

Most phishing emails share common structural elements designed to trigger action before the target thinks critically.

Red Flags to Look For

Fake Sender Domain The most reliable indicator. Attackers register lookalike domains:

Legitimate: support@microsoft.com
Phishing: support@micros0ft.com or microsoft-support.helpdesk.xyz

Urgent or Threatening Language Phrases like “Immediate action required”, “Your account has been compromised”, or “Final notice” are designed to bypass rational decision-making.

Suspicious Links Always hover over links before clicking. Look for:

Domains with hyphens: paypal-secure-verify.com
Unusual TLDs: .xyz, .ru, .tk
URL shorteners hiding the real destination

Unexpected Attachments Invoice PDFs, “HR documents”, and zip files are common malware delivery vehicles. Do not open attachments from unknown senders.

⚠️ Important Note on AI: Historically, spelling and grammar errors were strong indicators of phishing. Modern attackers now use AI to craft error-free, professional-sounding messages. Grammatical correctness alone no longer makes an email safe.

🧪 Test Yourself: Google Phishing Quiz — can you spot the phishing attempt?

Impersonation

Attacker poses as IT support, HR, a manager, or an executive. Often used in combination with a pretext — a believable story that justifies the request.

Example: “Hi, this is IT. We noticed unusual activity on your account. I need to verify your credentials to secure it.”

Pretexting

Creating a fabricated scenario (pretext) to build trust and extract information.

Example: “I’m calling from your bank’s fraud department. We’ve flagged suspicious charges. To cancel them, I’ll need to verify your card details.”

Baiting

Offering something attractive to lure the target — free software, gift cards, exclusive downloads.

Example: A USB drive labeled “Q3 Salary Reviews” left in a company car park. Curiosity drives people to plug it in.

Tailgating (Physical Attack)

An attacker follows an authorized person through a secured door without scanning their own badge.

Defense: Never hold doors for unknown individuals in secure areas, regardless of how inconvenient it feels.

📖 Reference: MITRE ATT&CK — Phishing (T1566)

5. Business Email Compromise (BEC)

BEC is one of the most financially damaging forms of cybercrime globally. It involves impersonating executives, vendors, or business partners to commit financial fraud.

Common BEC Scenarios

CEO Fraud An employee receives an email appearing to be from the CEO requesting an urgent wire transfer. The email is spoofed or the CEO’s account is compromised. No malware is involved — the attack succeeds purely through manipulation and authority.

Invoice Fraud A vendor’s email is compromised. Attackers intercept payment discussions and redirect funds to an attacker-controlled account by changing bank details on invoices.

Payroll Diversion Attacker impersonates an employee and requests a change to their direct deposit account before payday.

📖 Reference: FBI BEC Statistics — IC3 Annual Report

6. Real-World Case Studies

Charter Communications

A vishing (voice phishing) attack targeting employees led to the exposure of millions of customer records. Attackers called employees pretending to be IT support and convinced them to provide system credentials over the phone.

Lesson: Technical controls alone cannot prevent an employee from reading out their password to a convincing caller.

Carnival Corporation

A compromised employee email account — likely obtained through phishing — was used to access systems containing the data of nearly 6 million individuals.

Lesson: One compromised account, without MFA enforcement, can expose the entire organization.

Betterment (2026)

Social engineering was executed through a third-party platform, bypassing Betterment’s own security controls entirely.

Lesson: Your security posture is only as strong as your weakest vendor. Third-party risk management is not optional.

📖 Reference: Verizon Data Breach Investigations Report — tracks social engineering as a primary attack vector annually.

7. Information Gathering & the Danger of Oversharing

Before executing a targeted attack, attackers perform OSINT (Open Source Intelligence) — gathering information from publicly available sources to craft believable attacks.

Where Attackers Find Information

Source	What They Look For
LinkedIn	Job titles, org structure, who reports to whom, recent projects
Facebook / Instagram	Work events, travel plans, relationships, work badges in photos
Company website	Staff directory, email format, technology stack
Twitter / X	Work frustrations, system outages, IT issues
Job listings	Technologies used internally (reveals attack surface)

Work badges in photos — attackers can clone physical access cards
Travel plans — signals you’re out of the office
Internal project names — gives social engineers conversation ammunition
Who your IT provider is — enables impersonation attacks
Complaints about specific internal tools — attackers pose as the vendor offering “help”

📖 Reference: OSINT Framework — see what information is publicly accessible about you or your organization

8. Warning Signs — The Red Flag Checklist

When evaluating any request, communication, or link, run through this checklist:

☐ Is the sender domain exactly correct? (not a lookalike)
☐ Was this email/message expected?
☐ Does the request involve urgent action?
☐ Is there pressure to bypass normal process?
☐ Does the link match where it claims to go? (hover first)
☐ Is an attachment attached that I wasn't expecting?
☐ Is this person asking for something they should already have access to?
☐ Is the request for a one-time password, PIN, or verification code?
☐ Does the tone feel slightly off for the supposed sender?
☐ Am I being asked to keep this conversation private or secret?

If 2 or more boxes are checked, stop and verify through a separate, trusted channel — not by replying to the same message.

Real Example from the Session

During the workshop, Macaulay Esene shared a personal account: an attacker contacted him via WhatsApp claiming to be verifying attendance for a meeting. The goal was to obtain a One-Time Password (OTP). The combination of a plausible context + familiarity nearly worked.

Key insight: Legitimate organizations will never ask you to share an OTP. If someone asks for it, it is always an attack.

9. Interactive Exercise — Spot the Phish

During the session, two emails were presented. Participants correctly identified Email B as the phishing attempt based on:

High-pressure language: download attachment within 30 minutes
Salary offer bait (greed trigger)
Urgency combined with fear of missing out
Request to act before verifying the sender

The technique: Combining fear (missing the offer) + urgency (30-minute window) disables critical thinking and drives impulsive action.

Smishing Example Analyzed

“URGENT: Your [Bank] account has been restricted. Verify now to avoid suspension: bit.ly/b4nkverify”

Red flags identified:

Urgency language (“URGENT”, “avoid suspension”)
URL shortener hiding the real destination
Generic “[Bank]” — attackers send mass messages hoping someone has that bank

10. Mitigation & Cyber Hygiene

Multi-Factor Authentication (MFA)

MFA is the single highest-impact control you can implement today. Even if an attacker obtains your password through phishing, MFA prevents login without the second factor.

Types of MFA (strongest to weakest):

Hardware security keys (YubiKey) — phishing-resistant
Authenticator apps (Google Authenticator, Authy) — strong
Push notifications — moderate (vulnerable to MFA fatigue attacks)
SMS OTP — weakest but still better than nothing

⚠️ Note: MFA fatigue attacks bombard users with push notifications until they approve out of frustration. Use number matching where available.

📖 Reference: CISA MFA Implementation Guide

Verification Before Action

For any request involving:

Money transfers or invoice changes
Credential resets or access changes
Sensitive data sharing
Urgent requests from executives

Always verify through a separate trusted channel. Call the person directly on a known number. Do not use contact details provided in the suspicious message itself.

Check If You’ve Been Compromised

🔎 Tool: Have I Been Pwned — check if your email or password has appeared in a known data breach. If yes, change that password everywhere it was used.

Build a Security-Aware Culture

Individual vigilance is necessary but insufficient. Organizations need:

Phishing simulation programs — test employees regularly with fake phishing emails
Clear reporting procedures — make it easy and judgment-free to report suspicious emails
Security awareness training — not once-a-year compliance training, but continuous, practical education
Incident response planning — what happens when someone does click? Have a plan.

📖 Reference: SANS Security Awareness Training — industry standard framework for organizational security culture

Key Takeaways

Cyber attacks target people first, systems second. The human is the entry point in the majority of breaches.
Social engineering exploits emotional triggers — trust, fear, urgency, greed, and authority — to bypass rational decision-making.
AI has eliminated the grammar filter. You can no longer rely on typos to identify phishing. Verify sender domains carefully.
Oversharing on social media enables targeted attacks. Audit your digital footprint regularly.
MFA stops most account takeover attacks even after credential theft. Enable it everywhere.
Verify before you act. Any request that creates urgency or asks you to bypass normal process deserves scrutiny through a separate channel.
Everyone has a role. The CEO, the intern, the part-time moderator — every person is a potential entry point. Security awareness is everyone’s responsibility.

“Awareness is a strong defense. Vigilance is the organizational immune system.” — Workshop Conclusion

Resource	Description
OWASP Social Engineering	Comprehensive technical breakdown of SE attack types
CISA Phishing Guidance	US government guidance on identifying and reporting phishing
Google Phishing Quiz	Interactive quiz — test your phishing detection skills
SANS Security Awareness	Industry-leading security awareness training framework
Have I Been Pwned	Check if your credentials have been exposed in known breaches
MITRE ATT&CK — Social Engineering	Adversary tactics framework used by security teams worldwide
Verizon DBIR	Annual data breach report — tracks how real attacks happen
FBI IC3 BEC Report	FBI’s Internet Crime Complaint Center — BEC statistics and alerts
OSINT Framework	See what information is publicly accessible about you
CISA MFA Guide	Implementing multi-factor authentication effectively