Free lesson

Phishing and social engineering: recognise the pressure, then verify

Phishing and social engineering work by pushing you to act before you think, so the defence is a habit: pause, verify through a channel you already trust, then report. This lesson covers email, text, voice and AI-written lures and the pressure tactics they share, using NCSC and CISA guidance.

For you or your whole team

Start with a useful first step.

7-day free trial. No credit card needed.

You will continue on the Tosheo.ai app to create your account and review the trial terms.

What this lesson builds

Skills worth putting to work.

Naming pressure tactics

Recognising authority, urgency, emotion, scarcity and current events in any message.

Out-of-band verification

Checking requests through contact details you already trust.

Spotting AI-polished lures

Judging the request rather than the grammar or tone.

Reporting quickly

Reporting suspicious messages and your own mistakes without delay.

Example task / fictional source material

Handle Leah's three messages

Using the fictional Calloway Partners messages above, write for each one: the pressure tactic, why it is suspicious, the exact verification step and how it is reported. Then write a two-line note to colleagues about the pattern. Use fictional details only.

Review criterion

Tactics named

Each message has the right tactic or tactics identified, with the evidence.

Review criterion

Verification out of band

No step uses the message's own links, numbers or reply address.

Review criterion

Codes protected

The phone request for a code is refused and checked with the real provider.

Review criterion

Reported

Each message is reported through a named channel, internally and externally.

Copy and adapt

Prompts to try

Replace the parts in square brackets with your own details, and check every output before you use it.

Tactic spotter

Here is a message I received, with names and contact details replaced: [message]. Which pressure tactics does it use (authority, urgency, emotion, scarcity, current events)? Quote the words that show each one, and tell me how to verify it without using anything in the message.

Practice set

Write five realistic but fictional phishing messages aimed at a [job role]: one email, one text, one voice call script, one supplier invoice change and one genuine message for contrast. Give an answer key with the tactic and warning sign in each.

Team reminder

Write a 120-word reminder for [audience] on how to verify payment or bank detail changes, using one fictional example. Stress that reporting a mistake quickly is always welcome.

What is the difference between phishing and social engineering?

Social engineering is any attempt to manipulate a person into giving away information, money or access, and phishing is the most common form of it, delivered by email or a fake website. CISA also names the voice version, vishing, and the text message version, smishing.

Imagine a fictional 30-person architecture firm, Calloway Partners. On one Tuesday, the finance assistant, Leah, receives three things. An email from 'the managing director' sent at 7.58am: 'Leah, in a meeting all day, need you to pay the attached supplier today, new bank details, keep this between us'. A text: 'Your parcel is held, pay £1.45 redelivery fee here'. And a call from someone who says he is from the firm's IT provider and needs her to read out a six-digit code he has just sent 'to fix your mailbox'. Each one looks different. They are the same trick.

What pressure tactics do phishing messages use?

Phishing messages use five common pressure tactics, which the NCSC lists as authority, urgency, emotion, scarcity and current events. Spotting the tactic is more reliable than spotting a typo.

Authority

The message claims to come from a boss, bank, government body or supplier, so you feel you should comply.

Urgency

A tight deadline or threatened penalty, so you act before checking.

Emotion

Fear, panic, curiosity or hope, so you react instead of thinking.

Scarcity

Something in short supply, such as a refund window or limited tickets.

Current events

A link to the news, tax deadlines or a well-known outage, so the message feels expected.

How has AI changed phishing?

AI has made phishing messages more polished, so good spelling and grammar no longer prove a message is genuine. CISA's guidance now says this directly. Attackers can also write in a colleague's tone, tailor a message to your job, or imitate a familiar voice on a call. That makes the old checklist of spelling mistakes and odd greetings less useful, and makes verifying the request itself more important. A request to move money, change bank details, share a code or bypass a normal process should be verified however convincing it sounds.

How do you verify a suspicious message step by step?

You verify a suspicious message by stepping out of it: never use the links, phone numbers or reply address it gives you, and contact the person or organisation through details you already trust.

1. Pause and name the tactic

Ask which pressure is being applied. Secrecy plus urgency plus money is the classic payment fraud pattern.

2. Check the request, not just the sender

Display names and caller ID can be spoofed. A changed bank detail or a request for a code is the warning sign, whoever it appears to come from.

3. Verify out of band

Call the person on a number from your own records, or type the organisation's web address yourself. CISA and the NCSC both give this advice.

4. Never share codes or passwords

Genuine IT teams and banks do not ask you to read out a one-time code or password.

5. Report it

Use your email's report button and tell your IT contact. In the UK you can forward suspicious emails to [email protected]; in the US, CISA accepts reports through its Report a Cyber Issue service.

What does a weak and a strong response look like?

A weak response trusts the surface. Leah sees the managing director's name, replies to ask if the payment is really urgent, gets a quick 'yes, please do it now' from the same fake address, and pays. She ignores the text but, wanting to be helpful, reads the code to the caller, who uses it to sign in to her mailbox.

A strong response checks the request. Leah notices authority, urgency and secrecy together and calls the managing director's mobile from the staff list; he has sent nothing. She deletes the parcel text without tapping the link. She tells the caller she will ring the IT provider back, hangs up, and calls the provider on the number in the firm's contract; they made no call. She reports all three to IT and forwards the email to the reporting address. Nothing was paid and no code was shared.

What should you do if you already clicked or replied?

If you already clicked, replied or shared something, tell your IT contact at once, because speed limits the damage and nobody should be blamed for reporting. Change the password of any account you entered details into, from a different device, and turn on multi-factor authentication. If money or bank details were involved, call your bank straight away using the number on its website or your card.

What are the common phishing mistakes?

The most common mistake is replying to the suspicious message to check it, which only asks the attacker to confirm. Others: trusting a display name or caller ID, relying on spelling errors, clicking unsubscribe links, reading out one-time codes, and staying quiet after a mistake because of embarrassment.

Where does this lesson sit in Tosheo.ai?

This lesson sits in the Cybersecurity category and the cybersecurity course. In Tosheo.ai the practice task gives you a set of fictional messages, asks you to name the tactic in each, write the verification step and draft a report, and the rubric shows which warning sign you missed. It is awareness training for staff and managers, not a technical email-security course.

Sources and scope

NCSC, how to spot a scam email, text message or call (checked 19 October 2026) ↗

NCSC, report a scam email (checked 19 October 2026) ↗

CISA, recognise and report phishing (checked 19 October 2026) ↗

CISA, avoiding social engineering and phishing attacks (checked 19 October 2026) ↗

Before you decide

A few good questions.

What is social engineering in cyber security?

Social engineering is manipulating people, rather than hacking machines, to get information, money or access. Phishing emails, scam texts and fake support calls are all forms of it.

How can I tell if an email is phishing?

Look at what it asks you to do and how it pressures you. Urgency, secrecy, a request for money, codes or changed bank details are warning signs. Verify through contact details you already trust, never through the message.

Can AI-written phishing be spotted by bad grammar?

Not reliably. AI tools write fluent, well-spelled messages, so judge the request and the pressure behind it rather than the writing quality.

Where do I report a phishing email?

Use your email provider's report option and tell your IT contact. In the UK you can forward suspicious emails to [email protected]. In the US, CISA accepts reports through its Report a Cyber Issue service.

What if I already clicked a phishing link?

Tell your IT contact straight away, change any password you entered from another device, and turn on multi-factor authentication. If payment details were involved, call your bank on its official number.

Give your team a path, not another playlist.

Explore role-specific lessons, practical tasks and the manager view.

Start free trial7-day free trial · No credit card needed

Phishing and social engineering: recognise the pressure, then verify

Start with a useful first step.

Skills worth putting to work.

Naming pressure tactics

Out-of-band verification

Spotting AI-polished lures

Reporting quickly

Handle Leah's three messages

Tactics named

Verification out of band

Codes protected

Reported

Prompts to try

Tactic spotter

Practice set

Team reminder

What is the difference between phishing and social engineering?

What pressure tactics do phishing messages use?

Authority

Urgency

Emotion

Scarcity

Current events

How has AI changed phishing?

How do you verify a suspicious message step by step?

1. Pause and name the tactic

2. Check the request, not just the sender

3. Verify out of band

4. Never share codes or passwords

5. Report it

What does a weak and a strong response look like?

What should you do if you already clicked or replied?

What are the common phishing mistakes?

Where does this lesson sit in Tosheo.ai?

Sources and scope

A few good questions.

Keep exploring.

Cybersecurity course for working professionals

All free lessons

Lesson: malware and ransomware prevention

Lesson: incident response basics for small teams

Give your team a path, not another playlist.