One trick, many pipes#
A con artist wants you to do something you would not normally do: hand over a password, pay an invoice, hold a door. The technology is almost irrelevant. They are attacking the person, not the system, which is why no firewall setting fixes this.
The reason the vocabulary feels overwhelming is that the exam names a separate term for each combination of channel, target and technique. Once you see that, most of the list stops being memorisation.
| Term | What makes it that term |
|---|---|
| Phishing | Email, sent broadly to anyone |
| Spear phishing | Email, aimed at a specific person using details about them |
| Whaling | Spear phishing where the target is a senior executive |
| Vishing | Same trick, delivered by voice call |
| Smishing | Same trick, delivered by SMS text message |
Those last two are just the channel changing. If you can hear the word voice inside vishing and SMS inside smishing, you never have to revise them again.
The ones that are not just a channel#
A second group is defined by the method rather than the delivery route, and these are where exam questions get more interesting.
- Pretexting is inventing a believable situation to justify the request. The caller is not just asking for a password, they are "from the vendor, finishing last night's migration". Pretexting is the story, and it can be wrapped around any channel.
- Baiting leaves something tempting where a target will find it. The classic is a USB drive labelled "Redundancies 2026" dropped in a car park. The victim performs the attack themselves.
- Business email compromise is an attacker operating from, or convincingly imitating, a real internal mailbox to redirect a payment. What makes it dangerous is that it can arrive with no malicious link and no attachment, so filters see an ordinary email.
- Watering hole attacks compromise a legitimate site the target group is known to visit, rather than contacting them at all. The victims go to the attacker.
- Typosquatting registers a domain one keystroke away from a real one and waits for the mistake.
Pretexting is the story. Phishing is the delivery. A spear phishing email that claims to be from the IT helpdesk is using a pretext. The two terms describe different parts of the same attack, so a question can correctly use both.
The physical ones#
Three terms cover attacks that happen in a building rather than an inbox, and they are easy marks because they are concrete.
- Tailgating is following an authorised person through a door that they opened. Strictly, the term implies the person is unaware.
- Piggybacking is the same physical act with the authorised person's knowledge and consent, usually because they were persuaded to hold the door. The attacker carries a heavy box and somebody is polite.
- Shoulder surfing is simply watching someone type or reading their screen.
- Dumpster diving is retrieving useful information from discarded paper and hardware, which is why shredding and secure disposal are controls rather than housekeeping.
The control that answers tailgating and piggybacking is a mantrap or access control vestibule: a small space with two doors where the second will not open until the first has closed, so exactly one person passes at a time.
Why these work, and why that is testable#
Social engineering leans on a small set of pressures. Security+ expects you to recognise them, because the recognisable pressure is often the clue in a scenario.
- Authority. The request appears to come from someone who outranks you.
- Urgency and scarcity. A deadline removes the time you would have spent thinking. "The wire has to go out before close of business" is doing real work in that sentence.
- Intimidation. An implied consequence for refusing.
- Familiarity and trust. The attacker has done homework and mentions your manager by name.
- Social proof. "Everyone in your team has already completed this."
Notice that urgency plus authority is the combination in almost every invoice fraud: a senior person, a tight deadline, and a reason not to use the normal process. That pairing is the single most reliable tell in the whole topic.
The controls that actually answer it#
Because the attack targets people, the answer is rarely a purely technical control, and exam options are usually built to test whether you know that.
| Scenario | Best control |
|---|---|
| Finance paid a fraudulent invoice from a convincing email | Out-of-band verification, meaning confirm the request on a channel the attacker does not control, using a number you already had |
| Staff keep clicking links in test emails | Security awareness training plus simulated phishing campaigns |
| Strangers keep getting through the lobby door | Access control vestibule, plus a policy that makes it acceptable to refuse |
| Credentials were phished and reused immediately | Multifactor authentication, ideally phishing-resistant rather than one-time codes |
| Employees plug in USB drives they find | Disable removable media by policy and by endpoint control |
One caution on multifactor authentication. It reduces the value of a stolen password, but attackers answer it with push fatigue, sending repeated approval prompts until somebody taps accept to make it stop. That is why number matching and hardware keys score better as answers than simple push approval.
Verify on a channel the attacker does not control, because every one of these attacks depends on you answering through the pipe they chose.
Test yourself in the free Kestrel Exams app
Topic-selectable practice — offline, no ads, no account.
Practice this topic →Frequently asked questions#
What is the difference between phishing and spear phishing?
Phishing is sent broadly to many recipients with no particular knowledge of any of them. Spear phishing is aimed at a specific person and uses real details about them, their employer or their colleagues to be convincing. Whaling is spear phishing where the chosen target is a senior executive.
What is the difference between vishing and smishing?
Only the channel. Vishing is voice, meaning a phone call, and smishing is SMS text message. The persuasion technique is the same as phishing in both cases, which is why the words are built from voice and SMS.
How is pretexting different from phishing?
They describe different parts of an attack, so both words can correctly apply at once. Pretexting is the invented story that justifies the request, such as claiming to be a vendor finishing a migration. Phishing describes the delivery, meaning the email itself. A phishing email usually contains a pretext.
What is the difference between tailgating and piggybacking?
Both mean entering a secure door behind an authorised person. In tailgating the authorised person is unaware. In piggybacking they knowingly allow it, usually because they were persuaded to hold the door. The control for both is an access control vestibule, sometimes called a mantrap.
Does multifactor authentication stop phishing?
It reduces the damage but does not stop it. Attackers use push fatigue, sending repeated approval prompts until the user taps accept, and real-time proxy pages can relay one-time codes. Phishing-resistant factors such as hardware security keys, or at minimum number matching, are stronger answers than simple push approval.
Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written — several of these exist because somebody asked.