Unit 1 Lesson 1 Handout

By the end of this lesson, you should be able to

Identify common psychological tactics used in Social Engineering attacks.
Explain what action the attacker wants the victim to take and what consequences that action can cause.
Use login records or login alerts to decide whether an Online Password Attack may be happening.
Explain how strong passwords, a Password Manager, and MFA reduce the risk of account takeover.

Core Knowledge

Social Engineering means attackers use psychological manipulation, instead of directly breaking a system, to trick users into unsafe actions.

Common channels include:

Email
SMS / Text Message
Social Media Message
In Person

Core check: if a message makes you scared or rushed, stop and inspect it first. Intelligence does not prevent emotional manipulation, and a professional-looking page is not proof of safety.

Two Common Psychological Triggers

Trigger	Meaning	Common Signs
Intimidation	Fear-based pressure	Threats about account suspension, grades, infected devices, or financial loss
Urgency	Time pressure	Immediate action, countdowns, last chances, or deadlines today

Attackers are not writing messages randomly. They are designing your emotional response. Intimidation makes people comply out of fear, and urgency makes people act before checking.

Expected Actions

The attacker uses emotion to push an action that can cause harm:

Requested Action	Possible Consequence
Click a malicious link	Reach a fake login page or a malicious download.
Enter credentials on a fake page	Give the attacker access to the account.
Download a malicious file	Install malware that can capture passwords or other information.
Share an OTP / verification code	Help an attacker pass an additional login check.
Reveal birthdays, addresses, or family/pet names	Help an attacker impersonate the user, answer security questions, or guess passwords.

Authentication is the process of proving you are who you claim to be. A password is one form of identity evidence.

Online Password Attack

An Online Password Attack means an attacker tries to log in through a real login page. They may use:

Common passwords, such as password123
Common password patterns, such as word + year + special character
Passwords from previous data breaches
Password dictionaries built from personal information

Three Warning Signs

Warning Sign	Why It Is Suspicious
Many failed login attempts in a short time	Many failures in a short time may mean someone is automatically trying passwords
Login attempts at unusual times	An unusual login time may not match the user’s normal behavior
Login from an unknown device	An unknown device may mean the login is not from the real account owner

One signal alone may not prove an attack, but multiple signals together can make the risk much higher.

3. Stronger Authentication

Strong Password

A strong password is not just “uppercase letters, numbers, and symbols.” More importantly, it should be:

Long
Random and difficult to predict
Unique to each account

Common weak password problems:

Using names, birthdays, pet names, or family member names
Reusing the same password across multiple websites
Only adding a year or exclamation point after a common word

Dictionary Attack

An attacker builds a list of likely passwords, often using the target's personal information, and submits guesses with automated tools.

Collect names and dates -> build a likely-password list -> try it at the login service

Password Manager

A Password Manager can generate and store a different strong password for each account. That way, if one website leaks a password, it does not directly affect every account.

A passphrase is a longer password made from multiple words. Use a long, unique, hard-to-predict phrase rather than a familiar quote or personal information.

MFA combines different factor categories: something you know (a password), have (a security key or authenticator), or are (biometrics). A second password is still the same category; combining categories reduces the risk from a stolen password.

Note: MFA is useful, but do not share verification codes with anyone. If an attacker tricks you into sharing the code, MFA can still be bypassed.

4. What To Do If Something Looks Suspicious

Remember this response flow:

Stop -> Verify -> Change Password -> Enable MFA -> Report

Step	What To Do
Stop	Do not keep clicking, entering passwords, or downloading files
Verify	Check the URL, sender, device, and login time; confirm through an official channel if needed
Change Password	If the account may be exposed, change the password immediately
Enable MFA	If MFA is not enabled yet, enable it as soon as possible
Report	Report suspicious messages or logins to the platform, school, or administrator

Changing a password is not the whole response: also review unusual account activity and use MFA when available.

Unit 1 Lesson 1: Social Engineering & Suspicious Login