School: Minister Destiny Testimony Schools Track: Adult Class: Certificate Topics — Year 1 (Foundations) · Home: Schools — Adult track Certificate behind this topic: "Cybersecurity Awareness: Social Engineering" — LinkedIn Learning, earned by Minister Destiny Marie Morgan (May 30, 2025) Founded and presented by: Minister Destiny Marie Morgan, Minister
This lesson is educational information from Minister Destiny Testimony Schools. It teaches the public body of knowledge in this subject — the same ground Minister Destiny studied for her certificate — in this school's own words. It is not the original course, it does not award the original credential, and it is not legal or medical advice. If you are in danger right now, call 911.
Before you start
- This school never asks your name. Your progress is saved to your student record, so you can pick up on any device. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
- Phishing is this subject's most famous child. This unit studies the parent: the manipulation of trust itself — by message, by phone, and in person.
- If any story here sounds uncomfortably familiar, you are in good company. These techniques are built to work on kind, helpful, busy people. The defence is not becoming colder; it is building verification habits that kindness can hide behind safely.
The lesson
Part 1. What Social Engineering Is
Social engineering is manipulating a person into giving up access, information, or money — persuading the human instead of breaking the machine. The attacker studies what makes people comply: we help those who seem authorised, we avoid conflict with apparent authority, we act fast in emergencies, we return favours, and we follow the crowd. None of those instincts is a flaw. They are the glue of decent society, which is exactly why they are worth attacking — and why the defence is never “stop trusting people,” but “add one verification step between the feeling and the action.”
Social engineers prepare. They research targets from public posts, company websites, breached data, and earlier small talk, then arrive knowing names, projects, family details, and routines. That research is why their stories feel so real: much of them is real — everything except the request at the end. Learn to notice the shape: a believable story, an emotional push, and then a request that requires you to break a normal rule — share a code, skip a check, hurry a payment, hold a door. The request, not the story, is where you defend.
Part 2. The Influence Principles Attackers Borrow
Psychologists describe general principles of influence; attackers simply weaponise them. Authority: uniforms, titles, jargon, and confident tone make us comply — a caller who “sounds like IT” is obeyed like IT. Liking: friendly, flattering, similar-seeming people lower our guard; attackers mirror your interests and speech. Social proof: “everyone in your department has already done this” makes the unusual feel normal. Reciprocity: a small favour first — help with a form, a free “security check” — creates pressure to return a bigger one. Scarcity and urgency: limited time and rare opportunity punish hesitation. Commitment: once we have said yes to something small (“confirm your name and department”), saying yes to the next, larger step feels consistent — the famous foot in the door.
Part 3. Pretexting and Impersonation — the Invented Story
Pretexting is the crafted false identity and scenario an attacker performs: the auditor who needs your login “for the inspection,” the new employee locked out before a client meeting, the researcher, the vendor, the detective. Good pretexts are boring on purpose; drama invites scrutiny, while routine invites autopilot. Impersonation targets include IT helpdesks (talked into resetting passwords and MFA for the real account holder's “twin”), executives (whose assistants are pressed for documents and payments), and service providers (talked out of control of a phone number, which then receives the victim's security codes).
Notice how much of this runs by phone and in person, with no malware anywhere. The controls are therefore procedural: identity verification steps that do not bend for confidence, seniority, or tears; call-back rules using numbers already on file; and a workplace culture where “let me verify that through the official channel” is a respected sentence, not an insult. At home, the same controls look like this: nobody legitimate needs your one-time code, your full card number read aloud to their number, or a payment made while they keep you on the phone.
Part 4. The Classic Cons — Tech Support, Refunds, and “Free” Help
The tech-support scam begins with a pop-up, a call, or a search ad claiming your device is infected or your account compromised. The “technician” walks you into granting remote access, shows you alarming but meaningless screens, and sells a worthless fix — or simply loots accounts while connected. Real companies do not cold-call about infections, do not advertise emergency help through pop-ups, and never ask you to pay for support with gift cards. The refund scam adds a twist: an email says you were charged for a subscription, you call the number provided, and the “agent” — who “accidentally” refunds too much — begs you to return the difference by gift card or transfer, manufacturing guilt and urgency. Your bank balance seems to confirm the over-refund, because the scammer, given access, moved your own money between your accounts.
Hanging up is a complete defence to both. Then verify from your own banking app or statement whether any charge or refund exists at all — almost always, nothing happened until the call created it. Older relatives are the favourite targets, not because they are less capable but because they were raised on a ruder-to-hang-up etiquette. Re-teaching that one politeness rule — you may always hang up on a money call — is protective gold.
Part 5. Romance and Family-Emergency Scams — When the Heart Is the Target
Romance scams build a relationship over weeks or months — attentive, admiring, always with a reason the camera fails and the meeting slips — until the emergency arrives: a customs fee, a medical bill, a stranded trip home, an investment that “we” should seize together. The victim is not buying a lie about money; they are protecting someone they love. That is why facts alone rarely rescue someone mid-scam, and why these frauds also recruit victims into moving money for others, adding legal danger to heartbreak. Family-emergency scams compress the same trick into minutes: a panicked call — “Grandma, it's me, I've been in an accident, don't tell Mum” — followed by a “lawyer” or “officer” demanding immediate bail or hospital payment, in cash or by transfer, with secrecy insisted upon.
The pre-agreed defences from the Phishing unit do the heavy lifting here: a family code word; a rule that any emergency money request gets verified by calling the person's real number; and a household understanding that secrecy is the scammer's demand, never the family's. If you suspect someone you love is inside a romance scam, lead with respect, not ridicule. The relationship they believe in is real to them. Bring evidence gently, involve their bank early — banks can add friction and flags — and expect the conversation to take more than one sitting.
Part 6. Physical Social Engineering — Tailgating and the Smiling Stranger, and How to Help Someone Targeted
Not all social engineering arrives by wire. Tailgating (or piggybacking) means following an authorised person through a secured door — carrying boxes, dressed as a courier, simply smiling with a coffee in each hand so you hold the door. Baiting leaves an infected or tracking-laden gift — a USB drive labelled “Salary Review,” a QR code on a flyer — relying on curiosity to carry it inside. Office dumpsters and unattended desks complete the picture: badges, sticky-note passwords, and printouts are harvested without a single computer being touched. The countermeasures are cultural: challenge politely (“Can I help you find who you're visiting?”), escort rather than wave through, and never let a held door become a moral dilemma. A workplace that thanks people for challenging the director's unbadged guest has understood the assignment.
Finally: helping someone who was targeted. Stay calm, stop further loss first (bank, passwords, account freezes), preserve messages and receipts, report to the FTC at ReportFraud.ftc.gov and, where money moved, to the bank and local police. Replace shame with a plan, and — when they are ready — debrief the shape of the attack using Part 1: story, emotional push, rule-breaking request. A person who can see the shape will spot the next attempt themselves, which is worth more than any warning you can give them about one particular scam.
Words to know — Social Engineering — How People Get Talked Into It
- Social engineering — manipulating a person into giving up access, information, or money instead of breaking technology.
- Pretexting — performing an invented identity and scenario to make a harmful request seem routine.
- Tailgating — following an authorised person through a secure door without presenting credentials of your own.
- Baiting — leaving a tempting item — a labelled USB drive, a flyer QR code — to lure a victim into carrying the attack inside.
- Impersonation — claiming to be a specific trusted person or role — IT, an executive, a bank officer — to borrow their authority.
- Social proof — the influence principle that makes a request feel safe because “everyone else has done it.”
- Reciprocity — the felt obligation to return a favour, exploited by giving a small one first.
- Tech-support scam — a fake infection or account warning that sells a worthless fix or steals access during a “repair.”
- Refund scam — a staged over-refund that pressures the victim into sending the “extra” money, which was their own.
- Call-back rule — verifying any surprising request by contacting the person or institution at a number or address already on file.
Myths vs facts — Social Engineering — How People Get Talked Into It
- Myth: Social engineering only works on the elderly or the naive. Fact: It works on busy professionals, executives, and IT staff — anyone whose helpful instincts can be given a believable story and a deadline.
- Myth: If they know details about me, they must be legitimate. Fact: Details are the cheapest part of the attack, harvested from public posts and old breaches. Research is not identity.
- Myth: Challenging a visitor or caller is rude. Fact: Verification is the ordinary professional standard. Only an impersonator is harmed by your polite check.
- Myth: Scammers are easy to hear — foreign accents and broken English give them away. Fact: Modern operations use fluent scripts, local numbers, and coached callers — and voice imitation. Judge the request, not the voice.
- Myth: Once someone has sent money to a romance scammer, facts will snap them out of it. Fact: The attachment is emotional, not informational. Respect, bank involvement, and patience rescue more people than ridicule does.
Think it through — Social Engineering — How People Get Talked Into It
A caller tells the front desk of a small clinic: “This is Daniel from your IT provider — we're seeing an active attack on your system right now. I need you to read me the code that just appeared on the reception computer so I can lock the attackers out.” The receptionist can see a code did appear when the caller asked her to open a page. The caller is polite, knows the clinic's name and her manager's first name, and says every minute counts.
Walk it through: (1) Spot the shape from Part 1: a believable story (an “active attack”), an emotional push (every minute counts — urgency and authority from Part 2), and a rule-breaking request: read out a security code, which no legitimate provider needs from a receptionist's screen. (2) Apply Part 3's procedures: knowledge of names proves research, not identity. (3) Use the call-back rule: end the call politely — “I'll call our provider back on our account number so you can help us” — and dial the number on file. The real provider confirms no attack and no such call. (4) Report internally so the next desk the caller tries is forewarned. The receptionist's sentence — courteous, unbending, and procedural — is social-engineering defence at its best, and it cost the clinic nothing at all.
Try this — Social Engineering — How People Get Talked Into It
- ☐ Agree or refresh a family code word and the rule: emergency money requests are always verified through the person's real number
- ☐ Write your own call-back list — bank, IT provider, insurer — with numbers taken from cards and statements, not from messages
- ☐ Practise one polite challenge sentence for callers and one for an unbadged visitor until both feel easy in your mouth
- ☐ Audit what a stranger could learn about you in ten minutes from your public profiles, and trim the most useful-to-a-scammer details
- ☐ Share the tech-support and refund scam shapes with one older relative, including the permission to hang up
Resources to keep — Social Engineering — How People Get Talked Into It
- Federal Trade Commission Consumer Advice — consumer.ftc.gov — imposter, tech-support, romance, and family-emergency scam guidance, and reporting at ReportFraud.ftc.gov.
- FBI Internet Crime Complaint Center (IC3) — ic3.gov — reporting internet crime including impersonation and romance fraud.
- Cybersecurity and Infrastructure Security Agency (CISA) — cisa.gov — social engineering and phishing guidance for individuals and organisations.
- National Cybersecurity Alliance — staysafeonline.org — plain-language explainers on manipulation tactics for the whole family.
What you earned / what's next — Social Engineering — How People Get Talked Into It
✅ Social Engineering — How People Get Talked Into It complete (quiz score 80% or higher): You can spot the story–pressure–request shape, name the influence levers being pulled on you, apply call-back and verification rules, and help a targeted family member without shame.
Your certificate
Minister Destiny Testimony Schools Certificate of Completion — Social Engineering — How People Get Talked Into It
This certificate is presented by Minister Destiny Marie Morgan, Minister
Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)
Date completed: ______________
Congratulations. You have learned to keep your kindness and your caution in the same hand — to verify without becoming hard-hearted. That balance protects everyone who trusts you. — Minister Destiny Marie Morgan
This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or the original course credential.
What's next: Return to the Certificate Topics for your next Year 1 Foundations topic.
Sources
- Imposter scams, tech-support and romance scam guidance, and ReportFraud reporting — Federal Trade Commission Consumer Advice (consumer.ftc.gov) — scam shapes and victim steps.
- Internet crime and impersonation reporting — FBI Internet Crime Complaint Center (ic3.gov) — family-emergency and romance fraud reporting.
- Phishing and social engineering guidance — Cybersecurity and Infrastructure Security Agency (cisa.gov) — influence tactics and verification habits.
- National Cybersecurity Alliance awareness resources — National Cybersecurity Alliance (staysafeonline.org) — plain-language manipulation explainers.
Course Record — Social Engineering — How People Get Talked Into It
- Learning outcomes: On completing this unit, the student can:
- define social engineering and identify its story–pressure–request shape in a new example
- name the influence principles attackers use — authority, liking, social proof, reciprocity, scarcity, commitment — and the feeling each produces
- explain pretexting and impersonation and apply identity-verification and call-back rules that do not bend for confidence
- describe how tech-support and refund scams work and the hang-up-and-verify defence
- apply code-word and verification habits against romance and family-emergency scams, and respond to a targeted person without shame
- recognise tailgating and baiting and use a polite challenge in a physical setting
- Study time: Approximately 1.5 hours — an estimate covering reading, activities, and the test. Students move at their own pace.
- Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
- Level: Certificate Topics — Year 1 (Foundations) · Adult school · working rank on completion path: Freshman → Sophomore.
- Version: Version 1.0 — October 2026.
Minister Destiny Testimony Schools — Adult. Educational information only. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).