Lesson 7.9

Phishing, Scams & Social Engineering

Estimated time: 8 minutes

Cybercriminals do not always “hack” technology.

Sometimes they hack people.

They create messages that make someone:

afraid
curious
excited
rushed
trusting

Then they ask the person to take an action.

Nigeria’s Computer Emergency Response Team (ngCERT) has repeatedly warned about phishing, impersonation, fraudulent websites, credential harvesting, WhatsApp/SMS scams and business-email compromise. In August 2026, ngCERT specifically warned that attackers increasingly exploit trusted identities, organizational hierarchy and legitimate business processes to deceive personnel into transferring money, changing payment details or revealing sensitive information.

Common Warning Signs

A message may say:

“URGENT: The managing director needs this payment now.”

“Your account will be closed in 10 minutes. Click here.”

“I changed my bank details. Use this account immediately.”

“Send me your password so I can fix the problem.”

“Congratulations! Open this attachment.”

The Sender Appears Familiar

Do not assume a message is genuine merely because:

the name is familiar
the profile photo is correct
the email looks almost correct
the person knows internal information

Accounts can be compromised.

Names and photographs can be copied.

Good Habit

Stop → Check → Verify → Then act.

For an unusual financial or sensitive request, verify independently through an approved channel.

If You Already Clicked

Do not hide it out of embarrassment.

Prompt reporting may help the organization respond faster.

More Workplace Examples

Fake boss message

A message using the manager’s photo asks an employee to make an unusual urgent payment.

BETTER RESPONSE

Verify independently through the approved channel using a known contact. Do not treat a familiar photo as authorization.

Fake bank or payment link

A message claims a payment will fail unless the employee opens a link and enters account details.

BETTER RESPONSE

Do not enter sensitive information through an unverified link. Check through the approved banking or workplace support process.

Urgent password request

Someone claiming to provide technical support asks for an employee’s password immediately.

BETTER RESPONSE

Do not disclose it in response to the message. Use the approved support channel to verify and report the request.

Supplier account change

A supplier message gives new bank details for an invoice.

BETTER RESPONSE

Follow the organization’s independent verification and authorization process before any change or transfer; do not verify only by replying to the same message.

Suspicious attachment

An unexpected attachment arrives claiming to contain a staff bonus list.

BETTER RESPONSE

Do not open it out of curiosity. Report it through the approved process; if already opened, report promptly rather than hiding it.

Remember

A security mistake becomes harder to contain when people hide it.