Scams and attacks on people

Explain what phishing is and what a phishing message almost always asks for in the end, regardless of the story it tells.

You receive this SMS: 'Your parcel could not be delivered. Pay $0,99\ \text{€}$ customs fees here: envios-aduana.info'. Point out at least two details in the message that should make you suspicious and explain what would probably happen if you paid.

The figure shows an email impersonating a bank, with three warning signs already highlighted and one more element marked with a question mark.

Explain why each of the three marked signs reveals the fraud and what you should check regarding the element marked with ? before clicking anything.

Why do phishing messages almost always imitate well-known brands (banks, delivery companies, streaming services)? Explain what the attacker achieves by disguising themselves as a brand people already trust.

Explain the difference between unsolicited email (advertising spam) and phishing, give a made-up example of each, and describe what should be done with each type of message.

Observe these four links received in an instant messaging text:

1. https://banco-santander.seguridad-acceso.com/login

2. https://www.bancosantander.es/es/particulares

3. https://www.banc0santander.es/acceso

4. https://bit.ly/3xK9LqP (shortened link whose hidden real destination is http://santander.login.ru)

1. a) Break down the structure of link 1 (protocol, subdomain, main domain, and path) and demonstrate which real server the victim would connect to if they click on it.
2. b) Explain the exact technical procedure to check the real destination of link 4 without opening it, both in a desktop browser and on a mobile phone.
3. c) Justify why link 3 is an example of 'typosquatting' and what added risk it poses on mobile screens with condensed fonts.

An account with the name and photo of your cousin writes to you asking for urgent money due to a problem. Explain what checks you would carry out before responding and why the name and photo of an account do not guarantee who is behind it.

Define what social engineering is and apply it to this case: someone calls your home posing as a technician from the internet company and asks to install a program 'to fix the connection'. Point out what persuasion techniques they use and how your family should act.

Your mother receives a message: 'Mum, I lost my phone, this is my new number. I need you to make an urgent bank transfer to me'. Explain the 'child in distress' tactic, what check would instantly expose the scam, and what family rule (for example, an agreed codeword) you would propose.

An email announces that you have won a mobile phone in a prize draw you do not remember entering; to 'send it to you', they ask for your full name, address, and a photo of your ID card. Analyse what data they are trying to obtain, what it could be used for later, and what you should do with that email.

In a paid parking area in your town, the official sign has a QR code to pay, but someone has stuck a sticker with another code over it, as shown in the figure.

Explain the risk of paying by scanning the code marked with ?, how you would check which is the official payment system, and what secure alternative exists to pay without using that code.

An influencer announces a 'giveaway' of headphones: to enter, you must follow several accounts, fill out a form with your details, and pay the 'postage fees'. Analyse what three different objectives the organizer achieves with each requirement and why the prize probably does not exist.

Analyze the following table showing three attacks suffered by the staff of an educational center:

1. SMS from the sender 'CORREOS' notifying about a detained package with the link 'bit.ly/paq-34'.

2. Call from an alleged technician from the Department of Education asking verbally for the SMS code that just arrived on the principal's mobile phone to "update the school's firewall".

3. Email from 'soporte@educa-madrid.org' (the official domain is 'educa.madrid.org') with an attachment 'actualizacion.pdf.exe'.

1. a) Explain what technical limitation of traditional telephony allows the caller ID (CLI) or the alphanumeric sender to be spoofed so easily in smishing and vishing compared to email.
2. b) Predict what would happen if the principal provides the code in case 2 and justify why SMS two-factor authentication (2FA) is bypassed in this social engineering attack.

In a cybersecurity drill at a 200-employee software company, the technical department sends two simulated phishing campaigns:

• Email A (Generic): "You have won a €100,00 gift voucher. Click here to redeem it". Sent on a Tuesday at 10:00.

• Email B (Contextualized): "Urgent: Synchronization error in the code repository before deployment. Confirm your credentials before 18:00 to avoid losing your changes". Sent on a Friday at 17:45.

Results: 2,5 % of the staff fell for email A; 38,0 % fell for email B, including senior engineers.

1. a) Interpret the obtained data: what cognitive, temporal, and contextual factors explain the huge difference in success between both emails?
2. b) Technically refute the statement of an executive who claims: "Training employees better is enough; it is the user's fault for not looking at the link closely".
3. c) Propose two system-level technical measures (such as FIDO2 keys or corporate password managers) that prevent account theft even if the user falls for the trap in email B.

A user types "banco nacional customer login" into a web search engine. The first sponsored result (ad) shows the title "Banco Nacional - Customer Login", but upon clicking, the browser bar displays: 'https://banc0naci0nal.es-web.net/login'.

1. a) Explain how this attack vector (malvertising and search engine poisoning) differs from traditional email phishing and why it generates a much higher deception rate.
2. b) The fraudulent website has a valid SSL/TLS certificate (it shows the closed padlock in green/gray). Justify the difference between connection encryption and authentication of the identity of the website owner.
3. c) Design two technical browsing habits for critical services (banking, institutional email) that completely neutralize this attack vector without relying on search engine results.