Social Engineering Technique Identifier (Advanced)

About this interactive

The base version of this activity sorts by channel: email, phone, text, door. This one mixes channel bins with mechanism bins, so several scenarios touch two techniques, and the skill is deciding which one the attack depends on. Three rules settle every overlap in this set. First, a technique named for its channel wins on that channel. Vishing is social engineering by voice and smishing is social engineering by text message, so a caller who claims to be from a bank fraud team is still vishing, and a text that pretends to come from a manager is still smishing. Pretexting, a made-up but plausible story told to gain trust, is the answer when the story is told face to face or the channel is not the point, such as a visitor who says a fire inspection is overdue and needs the floor plans. Second, separate what is left lying from what is traded. Baiting leaves an enticing offer and waits for curiosity or the wish for something free to do the rest, and the offer does not have to be a physical object. Quid pro quo is an exchange of something for something, such as a gift card offered for answers about the network, or a bribe paid for access. Bait is left; a quid pro quo is a deal. Third, at a door, consent decides. Tailgating is following an authorized person through an entry point without their consent, usually because they never notice. If the authorized person holds the door and lets the attacker in, it is piggybacking, the same attack with consent, and this set has no bin for it: every door scenario here is the unnoticed kind. Two bins need no overlap rule. Shoulder surfing is direct observation of information as it is entered, with no message, story or offer; distance is not the test, so a camera or someone across a room counts as well as someone at your shoulder. Whaling is spear phishing aimed at the top of the company, the chief executive or another chief officer. The seniority of the target is the whole difference, and it matters because an executive can approve a payment or waive a control that an ordinary account cannot. Real attacks chain techniques, and a question that accepted every true label would have no answer. Name the technique the rules above point to, not every technique the scenario touches.

What you'll learn

Classify advanced social engineering scenarios by technique with precision across 8 types: Pretexting, Vishing, Smishing, Baiting, Tailgating, Quid Pro Quo, Shoulder Surfing, and Whaling
Distinguish whaling (targeting C-suite) from spear phishing (any targeted individual)
Recognize shoulder surfing as a physical information gathering technique distinct from pretexting or tailgating

Aligned to

CompTIA PenTest+

4.8 Given a scenario, perform social engineering attacks using the appropriate tools.

3.3 Explain physical security concepts.

CompTIA Security+

2.2 Explain common threat vectors and attack surfaces.

5.6 Given a scenario, implement security awareness practices.

Key terms

Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Pretexting: A social engineering technique in which an attacker fabricates a convincing scenario — such as impersonating IT support, a vendor, or an authority figure — to manipulate a target into performing an action or disclosing sensitive information.
Vishing: A voice-based social engineering attack in which an attacker uses phone calls or voice messages to manipulate targets into revealing sensitive information or taking a harmful action such as transferring funds or resetting credentials.
Smishing: A social engineering attack delivered via SMS text messages that tricks recipients into clicking malicious links, calling fraudulent numbers, or revealing sensitive information such as account credentials or financial data.
Baiting: A social engineering technique that uses an enticing offer or lure to trick a victim into taking an action that compromises their security.
Tailgating: A physical security breach where an unauthorized person follows an authorized individual through a secured entry point without presenting credentials.
Quid Pro Quo: A social engineering attack technique involving an overt exchange of something for something, such as offering a benefit in return for access, credentials, or sensitive information.
Shoulder Surfing: An attack in which an adversary physically observes a victim entering credentials or access information by looking over their shoulder or from close proximity.
Whaling: A type of spear phishing attack that targets high-level executives or senior leadership within an organization, such as CEOs or C-suite members.
Spear Phishing: A targeted phishing attack directed at a specific individual or organization using personalized information.
Piggybacking: A physical security attack where an unauthorized person follows an authorized person through a secured entry point with the authorized person's consent, typically by deceiving them.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →