Phishing, blagging, baiting, shouldering — attacking people rather than systems. A guaranteed topic on Component 1. Sourced from Craig 'n' Dave Topic 5 slides.
Craig 'n' Dave · Edexcel 1CP2Social Engineering Attacks
Key facts
Social engineering — attacking people, not computers
Social engineering is the art of manipulating people so they give up confidential information
It exploits human psychology (trust, fear, curiosity) rather than technical vulnerabilities
Often the easiest way into a secure system — people are the weakest link
Types of social engineering attack — fill in the table
Attack type
Description
Phishing
Blagging (pretexting)
Baiting
Shouldering (shoulder surfing)
Preventing social engineering — fill in the table
Measure
Description
Staff training
Verify identity
Email filters
Clear screen policy
USB restrictions
Security culture
Exam questions — 5 questions · 12 marks
⚡ This module includes extended questions (4–6 marks). Read the hint. Write in full linked sentences. The AI will tell you exactly which mark scheme points you missed.
1 markPhishing definitionEdexcel 1CP2 style
Which of the following best describes a phishing attack?
A Physically watching someone enter their PIN number
B Sending emails pretending to be from a reputable source to trick users into revealing personal information
C Leaving a USB drive in a public place hoping someone will plug it in
D Calling someone pretending to be IT support to obtain their password
1 markBlaggingEdexcel 1CP2 style
A cybercriminal calls a company employee pretending to be from the IT helpdesk and asks for their password to "fix an urgent problem". What type of attack is this?
A Phishing
B Baiting
C Shouldering
D Blagging (pretexting)
4 marksExplain a phishing attackEdexcel 1CP2 style
Describe how a phishing attack works and explain two technical measures a company could use to reduce the risk of phishing attacks being successful. (4 marks)
Hint: Describe the attack (how it works, what the attacker does, how the victim is tricked). Then give two specific technical measures — not just "educate staff".
+40 XP
1 markBaitingEdexcel 1CP2 style
A USB drive labelled "Staff Salaries — Confidential" is left in a company car park. An employee picks it up and plugs it into their work computer. What type of attack is this?
A Phishing
B Blagging
C Baiting
D Shouldering
4 marksCompare technical and social engineering attacksEdexcel 1CP2 style
Explain why social engineering attacks are often more effective than purely technical attacks, and describe how organisations can defend against them. (4 marks)
Hint: Explain WHY humans are the weakest link (psychology over technology). Then give at least two defences — must go beyond just saying "train staff" and explain what the training should cover.