Why this matters
Phishing and social engineering are among the most common ways attackers get into organisations and personal accounts. Security teams in Ghanaian banks, telcos and fintechs review suspicious emails reported by staff every day, and adverts for analyst roles mention phishing analysis. Being able to break down a suspicious message clearly is a core, practical skill.
What social engineering is
Social engineering means manipulating people into doing something that helps the attacker: sharing a code, clicking a link, opening a file or sending money. Phishing is social engineering by message: email, SMS (sometimes called smishing), WhatsApp or social media. Phone based tricks are sometimes called vishing.
Attackers use the same levers again and again:
- Urgency: "Your account will be blocked in 30 minutes."
- Authority: pretending to be a bank, a telco, a boss or a government office.
- Fear or greed: a fine, a prize, a job offer, a loan.
- Trust: using a friend's hacked account or a familiar group name.
How to break down a suspicious message
Check these, in order:
- Sender: does the address or number really belong to the organisation? Look closely: is not the same as the bank's real domain.