Pretext, Phish, and Physical Tailgating

A pretext is a fabricated context that makes the unsafe request feel ordinary: “I’m with facilities,” “I’m the new contractor,” “I’m calling from payroll about a failed deposit.” The mechanism is identity-as-story. The requested action is usually a secret, a payment, a click, or a door. You already met this as authority in Lesson 1. The extra name helps you tag voice and in-person cons that never send an email. Vishing is pretext on a phone. You do not practice vishing. You notice that a cold caller who needs an MFA code, a password, or a wire is asking you to skip the official app.

Recognition card (fiction, inspect only): “Unexpected caller: we are IT, read the six-digit code on your screen now or your account locks.” Mechanism: pretext + urgency + MFA harvest. Refusal: hang up; use a number you already have; never read the code into the same call. That sentence is enough. A full dialogue tree, a caller-ID spoof recipe, and “try this on your roommate” are out. If a blog titled with a cert acronym publishes those trees as homework, that blog is not this course.

cat >> "$NOTES" << 'EOF'
pretext_means: a borrowed role to skip a check
refuse: actually calling a helpdesk as homework
EOF

Phishing is social engineering delivered as a message you already use — mail, SMS, chat, a QR on a poster. Topic 5 taught sender vs From domain, lookalike hosts, timers, and “open the official app / type the known site.” Spear phishing is the researched variant aimed at one role (finance, HR). Mass phishing sprays. Either way, the defensive move is the same: do not authenticate through the message’s link. This module does not add HTML kits, tracking pixels, or Gophish campaign click-paths. Those are how people harm classmates and call it a lab.

Recognition card (fiction, inspect only): “From display Payroll, host paypa1-security.example, subject Account locked in 15 minutes, body click to restore deposit.” Mechanism: phish (lookalike + urgency + credential ask). Refusal: do not visit; report via your mail client’s phishing control if it arrived in a real inbox later — this card is not a live host to curl. Topic 5’s spotter lab already scored fictional mail. You do not forward Sample energy to Finance “as a test.” You do not send a lookalike to family to “see who clicks.”

Tailgating (piggybacking) is following an authorized person through a badge door, loading dock, or garage gate so the lock never challenges you. The pretext is often a box, a badge that “isn’t working,” or being late to a meeting. Helpfulness is the mechanic: holding a door feels kind. Buildings use badges, turnstiles, and visitor logs because politeness is not authentication. You will not practice this on a campus, an office, or a neighbor’s building. You will write: I do not hold a controlled door for someone I cannot badge-in; I direct them to reception; I do not follow anyone in as homework.

Physical and digital lures stack. A phish that says “I’m downstairs, buzz me in” is still a people-test. A pretext at a desk that asks you to plug in a “forgotten USB” is baiting — Topic 1 named it; you still do not drop USBs in a parking lot. Dumpster diving as a CEH anecdote is not a Cyberlium assignment on someone else’s bins. Stay on recognition. The lab in Lesson 4 is a callback rule you write, not a building walkthrough.

se-scripts-notes.txt holds YOUR labels for the three fictional cards plus ethics. Required rows: disclaimer, pretext definition, phish definition (Topic 5 carry), tailgating definition, one refusal per shape, and a hard NEVER list (no kits, no sending, no calls against humans, no following people through doors). It does not hold a vishing script, a Gophish JSON, a SET command line, or a classmate’s phone number. The checker fails if campaign bait phrases appear. chmod 600 under $HOME/cyberlium-lab.

If the notes feel “too small” because you did not run a campaign, that is the point. Module 3’s scan lab was loopback. This lesson is even stricter: there is no authorized human listener equivalent to 127.0.0.1. Classmates did not bind their attention to your homework. Family did not sign RoE. Coworkers’ inboxes are production. Stop.

Fill the template in your words. Run the checker. chmod 600. Do not add a live inbox, a phone list, or a building address. Windows: WSL/Git Bash or restrict ACLs in your profile.

cat >> "$NOTES" << 'EOF'
tailgate_means: following an authorized person through a door
control: badges + challenge culture + cameras YOU own/admin
refuse: campus tailgate practice, RFID clone kits
EOF

You can now name pretext, phish, and tailgating as delivery shapes of Lesson 1’s mechanics — Topic 5 still owns the mail lure — and you treat performing those shapes on people as out of ethics and out of this course. Notes are locked. This is original Cyberlium teaching mapped to the CEH v13 social-engineering domain, not official training, not a dump. Next — Countermeasures: Verify Out of Band — is callback rules, badges, MFA, and reporting.