Reconstruct a Social-Engineering Attempt

A social-engineering message is often designed to make the victim focus on the request instead of the sequence that produced it.

Defenders reverse that process.

They reconstruct the interaction:

What did the attacker know? What did they claim? What pressure did they create? What action did they want? What would happen next?

This lesson treats a social-engineering attempt as an evidence problem.

Synthetic case file

A teacher provides this fictional conversation:

08:41  Message from "Competition IT"
       We are validating driver-station accounts before Saturday.
       Your team is one of five that has not confirmed.

08:43  Student replies:
       What do you need?

08:44  "Competition IT":
       I just sent a verification code to your phone.
       Reply with the six-digit code so I can clear the alert.

Do not contact any real organization. This is a classroom artifact.

Observation before interpretation

List what the artifact actually shows:

• sender claims to be "Competition IT"
• sender references a competition
• sender says other teams already confirmed
• sender creates pressure by implying the team is behind
• sender requests a one-time verification code

Now separate unsupported conclusions:

• the sender definitely hacked the competition system
• the sender knows the student's password
• the code would definitely grant account access
• the sender is located in a particular country

The evidence does not establish those claims.

Map the pretext

A pretext is the story used to make the request believable.

Complete this table:

Add one row for information the attacker may have researched in advance.

What is the six-digit code?

The important defensive lesson is not that every six-digit code is dangerous.

The lesson is that authentication factors should not be handed to an unverified person simply because they claim to be support staff.

The student should verify through a known channel and follow the approved account-support process.

Reconstruct the seven-stage chain

Use the classroom attack-chain model from Lesson 1:

1. research
2. select target
3. build pretext
4. make contact
5. create pressure
6. request action
7. exploit result

For the synthetic case, fill in what the evidence supports at each stage.

Some stages may be unknown.

Write unknown instead of inventing an answer.

That is a valid analytical result.

Compare three variants

Variant A: phone call

A caller claims to be from a school help desk and asks the student to disable MFA temporarily.

Variant B: in-person request

A person carrying equipment asks a student to hold a secured door because their badge "stopped working."

Variant C: direct message

A new team account says a mentor needs the latest contact list and asks the student to upload it to an unfamiliar file-sharing service.

For each variant, identify:

• claimed identity
• requested action
• asset at risk
• influence technique
• independent verification path
• one policy that would reduce the risk

Information leakage before the attack

Social engineering becomes easier when public or casual information reveals too much context.

Examples might include:

• schedules
• team roles
• vendor names
• employee titles
• event travel plans
• screenshots with internal tools visible

This does not mean students should disappear from the internet.

It means information has context and value.

Ask:

Could this information help someone create a more convincing pretext?

Build an information-value map

Use a fictional robotics team profile.

The profile publicly lists:

• team number
• competition dates
• mentor first names
• sponsor names
• photos of the pit area
• public contact email

For each item, classify:

• normal public information
• information that could strengthen a pretext
• information that should be reviewed before posting

Explain your reasoning.

Do not label all information "secret." Defensive judgment requires balance.

Stop the chain earlier

Many security responses focus on the moment someone is asked for a password.

But the chain can be interrupted earlier.

Examples:

• limit unnecessary public details
• use clear support procedures
• teach people how official staff will contact them
• require independent verification for unusual requests
• design MFA so support staff never need the user's code
• create an easy reporting channel

Choose one of the three variants and design controls at three different stages of the attack chain.

Evidence for Lesson 2

Submit:

• pretext table
• seven-stage reconstruction
• comparison of Variants A, B, and C
• information-value map
• three-stage defensive plan

Finish with:

The earliest point where I could interrupt the attack is ________, by ________.

The best defense is often not recognizing the perfect scam at the last second. It is designing a process that makes the attacker's story less powerful from the beginning.