Social Engineering & Phishing

Social engineering is the manipulation of people into taking an action or revealing information that helps an attacker, such as clicking a link, entering a password, approving an MFA prompt or changing bank details. It exploits trust and normal workflows rather than technical vulnerabilities.

Yes. These checks only prove the message is authentic for the domain it claims. An attacker who registers a look-alike domain and configures it properly can pass all three. Always check whether the domain itself is the one you expect.

Read the hostname from right to left and find the registrable domain, such as verify-now.test in portal.example.com.verify-now.test. Everything to the left is a subdomain the attacker can name freely to look familiar.

Processes that require independent verification through a channel the attacker does not control, such as callbacks to known numbers and dual approval for payment changes, combined with phishing-resistant MFA, a visible report button and a no-blame reporting culture.

With FIDO2/WebAuthn the browser binds each credential to the real website's origin. A cloned page on another domain cannot request or receive that credential, so there is nothing for the victim to type in and nothing the attacker can relay.

DMARC passes only if SPF passes for the envelope sender domain or DKIM passes for the signing domain, and that domain matches the visible From domain. With an enforcing policy this stops exact-domain spoofing, but it does not protect against look-alike domains or display-name impersonation.