Threats, Vulnerabilities, and Attacks · Topic 8 of 10
Social Engineering and Physical Attacks
Security+ social engineering and physical attacks: phishing, smishing, vishing, quishing, whaling, deepfakes, tailgating, skimming and forced entry.
- 4 min
- Phishing is by email, smishing by text message, vishing by voice and quishing by QR code.
- Spear phishing targets specific people, and whaling targets senior executives.
- Impersonation pretends to be a trusted person. A deepfake uses AI generated audio or video to do it.
What it is
Social engineering is the manipulation of people to make them give up information, access or money. It attacks human trust and habit, not software flaws.
Physical attacks use real world access to reach systems, data or payment details. Both are scored on how well you spot the signs in a short scenario.
How it works
Why social engineering works
Attackers rely on authority, urgency, helpfulness and fear. A message from "the CEO" that needs a payment "before 5 p.m." uses two of these at once.
Technical controls help, but training and verification procedures are the main defense.
Phishing and its variants
Phishing is a fraudulent message that pretends to come from a trusted source to get a click, a login or a payment. The variants differ in the channel or the target.
| Technique | Channel or twist |
|---|---|
| Phishing | Mass email with a link or attachment |
| Spear phishing | A message aimed at a specific person or group, using personal details |
| Whaling | Spear phishing aimed at senior executives |
| Smishing | Phishing by Short Message Service (SMS) text |
| Vishing | Voice phishing, by phone call |
| Quishing | Phishing through a QR code that leads to a fake site |
Quishing works partly because a QR code inside an email is an image, which some filters do not read as a link. The user also cannot see the address before scanning.
Impersonation and deepfakes
Impersonation means pretending to be a specific trusted person or role, such as a manager, a supplier or a help desk technician. It is common in vishing calls and in requests to change payment details.
A deepfake is audio, video or an image created or altered with AI to imitate a real person. Attackers have used deepfake voices and video calls to pose as executives and approve payments.
Indicators of social engineering
| Sign | Suggests |
|---|---|
| Sender name matches, but the address or domain is slightly wrong | Phishing or impersonation |
| Urgent request to bypass normal process | Pressure tactic |
| Request for credentials, MFA codes or gift cards | Credential theft or fraud |
| Caller refuses a call back to a known number | Vishing |
| Video caller with odd lip movement or who avoids unscripted questions | Possible deepfake |
Physical attacks
| Attack | Description |
|---|---|
| Tailgating | Following an authorized person through a secure door without using a credential |
| Shoulder surfing | Watching someone type a password or PIN, or read a screen |
| Skimming | A hidden device on a card reader, such as a cash machine or fuel pump, that copies card data |
| Forced entry | Breaking a lock, door or window to get in |
Tailgating is stopped by access control vestibules, guards and a culture of challenging people without badges. Privacy screens reduce shoulder surfing, and inspecting card readers helps detect skimmers.
Forced entry leaves visible damage, so alarms, cameras and sturdy barriers are the controls. The other three leave few traces.
Defenses
| Defense | What it does |
|---|---|
| Awareness training | Teaches staff to spot and report attempts |
| Email filtering | Blocks known bad senders, links and attachments |
| Multifactor authentication (MFA) | Limits damage if a password is given away |
| Verification procedures | Requires a call back to a known number before a payment change |
| Access control vestibule or guard | Stops tailgating |
What to remember for the exam
- Phishing is by email, smishing by text message, vishing by voice and quishing by QR code.
- Spear phishing targets specific people, and whaling targets senior executives.
- Impersonation pretends to be a trusted person. A deepfake uses AI generated audio or video to do it.
- The best defense against payment fraud is verification through a separate, known channel.
- Tailgating is following someone through a door. Shoulder surfing is watching a screen or keypad.
- Skimming copies card data with a hidden reader.
- Forced entry is breaking in, and it leaves physical evidence.
When a payment or data request arrives and looks urgent, the correct response is usually to verify through a separate, known channel.
Common mistakes
Mixing up spear phishing and whaling. Both are targeted. Whaling is limited to senior leaders such as executives.
Mixing up smishing and quishing. Smishing is a text message. Quishing is a QR code, which may arrive by email, letter or poster.
Thinking MFA stops all social engineering. An attacker can still trick a user into approving a prompt or reading out a code.
Trusting a familiar voice or face. Deepfakes can copy both, so the process must not depend on recognizing someone.
Treating tailgating as a technical failure. It is a human behavior solved by policy, awareness and physical controls.
Check yourself
Which attack is phishing carried out through a QR code?
Quishing.
A finance clerk receives a video call from someone who looks like the CFO asking for an urgent transfer. What should happen?
Verify the request through a separate, known channel before paying, because it may be a deepfake.
What is skimming?
Using a hidden device on a card reader to copy card data.
Topic 8 of 10 in Threats, Vulnerabilities, and Attacks
Test yourself on Threats, Vulnerabilities, and Attacks
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.