Cybersecurity Awareness Month: Phishing & Social Engineering
- Triumvirate Cyber
- Oct 31
- 4 min read
Over the past few weeks, we’ve covered how to protect your accounts with strong passwords and multi-factor authentication (MFA) and why keeping your software up to date is essential for staying secure. In our final Cybersecurity Awareness Month post, we’re diving into some of the most common (and successful) threats out there: phishing and social engineering. These attacks don’t rely on fancy code or zero-day exploits. They rely on something much simpler: human nature.
What Is Social Engineering?
Social engineering is the art of tricking someone into doing something they shouldn’t: clicking a malicious link, sharing a password, or wiring money to the wrong place. It’s less “hacking the system” and more “hacking the person.”
In the context of cybersecurity, phishing is the most common form of social engineering, where attackers send emails or messages designed to look legitimate—from your boss, your bank, or even your IT team. Their goal is to get you to click, download, or hand over sensitive information they can use for nefarious purposes.
Other tactics include smishing (via SMS/text), vishing (via phone calls), and spoofed login pages mimicking real websites. Think of it like digital con artistry: the attacker doesn’t need to break in if they can convince you to open the door.
Spotting the Bait
Phishing works because it plays on emotions—most often urgency, fear, curiosity, or trust. A convincing message might say things like:
“Your account has been suspended. Click here to restore access within 24 hours to prevent deletion.”
“HR needs you to review this updated policy immediately. Your paycheck will be held until acknowledgement is received.”
“As a reward for being one of our most reliable employees, management has approved a $50 Amazon gift card! Log in to accept.”
Even with all the technical defenses your IT team can conjure, attackers are constantly devising new and clever ways to get around them. That’s why it’s critical for you—the target—to know what to look for and how to protect yourself against social engineering threats.
Recognizing the Red Flags
There are many ways to identify a message as potentially suspicious, but often there isn't a single dead giveaway. By keeping an eye out for red flags, you give yourself a chance to to catch something potentially suspicious and investigate further before you respond.
The first and foremost tip is to take a moment to pause—reacting immediately to something that seems urgent or alarming is exactly what attackers want you to do! They’re trying to play on your emotions to get you to bypass the reasoning part of your brain that asks, “Is this legitimate? Is this something I should be doing?”
Here’s how to keep your cool when something feels off:
Check the sender’s address: A message from billing-manager@microsoft.com-evilphishingschemehahaha.biz is not your friend—and certainly not Microsoft’s billing manager! At first glance, the address can look legitimate, but make sure you look at the whole thing and not just who the sender claims to be! Attackers often try to hide their malicious intent behind trusted companies and brand names.
Hover before you click: When you hover your cursor over a link, you can usually see the real destination—and it may be very different from the text that’s displayed! For example, hover over this link which allegedly will take you to accounts.google.com. That’s definitely not where we thought we were going, is it?
Sometimes, it can be difficult to parse the URL that appears when you hover over a link because of things like SafeLinks encoding or URL shorteners (like bit.ly). If you’re not sure a link is safe, don’t click it! Type the legitimate domain into your browser instead.
Watch for inconsistencies: Typos, weird logos, and odd phrasing can all be giveaways. With the rise of large language models (LLMs) like ChatGPT, Copilot, and Gemini, it has become much easier for attackers who don’t natively speak a language to craft convincing messages—and sometimes us humans make honest mistakes too! This isn’t a guaranteed method to catch every phishing attempt, but it can be combined with other information to help figure out whether you should trust a given message.
Pause on urgent or emotional language: As mentioned above, one of the most common social engineering tactics is to prey on strong emotions. Real organizations rarely demand immediate action or threaten suspension within minutes. Take a moment to consider the context and use the other techniques you’ve learned in the section before you follow up on an email that says “EMERGENCY SOS ACCOUNT DELETION IMMINENT!!”
When in doubt, ask: If you’ve gone through all the steps above and you still aren’t sure whether something is legitimate, contact the supposed sender through a trusted method—not by replying to the suspicious message. Send a new message to a known email address, call/text them directly if you know their number, or (if they’re physically nearby) walk over and double check in-person.
Awareness is a key component of cyber hygiene. Technology can’t protect us from what we would voluntarily give away. People are the first and last line of defense, so training and awareness can make it much harder for social engineering attempts to succeed.
Practical Tips to Stay Phish-Free
Beyond the red flags to look out for that we covered above, the following tips can help you avoid getting hooked by a scammer:
Slow down: Attackers want you to rush. They want you to act without thinking. Taking a moment to pause is often your best defense
Never share credentials over email, text, or phone
Use multi-factor authentication (MFA) so even if credentials are stolen, they’re useless on their own
Report suspicious messages to your IT or security team—you might save someone else from taking the bait!
Cyber Awareness Never Ends
As Cybersecurity Awareness Month wraps up, remember that the goal isn’t to turn everyone into security experts—it’s to build habits that make our digital lives safer.
Between strong passwords, MFA, timely update installation, and a healthy dose of skepticism toward unexpected requests, we’ve built a strong foundation. Cybersecurity isn’t about fear. It’s about preparation, understanding, and learning how to protect yourself.
Whether you’re a tech wizard or a cyber novice, we hope you’ve learned something this Cybersecurity Awareness Month. Keep these tips in mind all year and you can be more confident in your digital security—whether you’re shopping online, posting cat videos, or managing an enterprise!
