Social Engineering is a term that is thrown around quite a lot. You've probably heard about it in passing on TV or maybe even in the news. But what exactly does it mean? Social Engineering is a form of hacking, but instead of using technical means to access your data, they try to trick you into giving out your information willingly. This can be done over the phone, through email, or even sometimes in person through physical manipulation. Unfortunately, most people are not aware when they are being targeted by this kind of attack which makes them all the more dangerous because if you don't know about them, you won't be able to protect yourself against them.
The different types of social engineering
Social engineering is a tactic used by cyber criminals to trick individuals into revealing sensitive information. It's one of the most common ways cybercriminals attack because it works so well.
Cybercriminals use social engineering because it's easier than trying to work through the security of a company's computer network. Social engineering can take the form of an email, text message, or phone call and often relies on human nature--people tend to want to help others with problems that they're having (even if those problems aren't real).
Recognize that you are a target.
Don't be fooled by the idea that you're too smart to fall for a phishing scam or other social engineering attack. As we've seen, these attacks are designed to take advantage of human nature and use our weaknesses against us. The best way to protect yourself from these tactics is by recognizing that you are:
A target.
Knowing what cyber criminals want from you (and why).
Being aware of what they might try next.
Be aware that phishing messages appear authentic.
Phishing messages look like they come from a legitimate source. They often contain links to websites that look like the real thing and may even use the same colors and fonts as the original website. In addition, phishing messages can have misspelled words or grammatical errors. Still, these are usually corrected by artificial intelligence (AI) programs, making it harder for you to spot them as fake.
If you receive a suspicious email, don't click on any links! Instead, open up your web browser and go directly to the website in question by typing in its URL manually into your address bar--you'll know if this is correct because you will see "https://www" at the beginning of any legitimate URL (this stands for "hypertext transfer protocol secure").
How can you tell if you're being phished?
Here are some things to look for when you're trying to determine whether or not an email is legitimate:
Spelling and grammar errors. If an email has a lot of spelling, punctuation, or grammatical mistakes, it's probably fake. An honest company wouldn't make those kinds of errors--they'd have someone proofread their emails before sending them out to look professional and not offend customers' sensibilities (and therefore drive away potential sales).
Sender's email address doesn't match the domain name of the website it links to. If your friend sends you an email from his personal account, but the link goes somewhere else entirely (like another service provider), something fishy might be happening here; there could be malware attached to this message as well!
Never give up personal information.
Never give out your personal information.
Never give out your credit card details, social security number, bank account details, or date of birth. Never reveal the name of your mother's maiden name either. No matter how convincing they sound and no matter how much they convince you that they are from a legitimate company or government agency: don't give up any information that could put you at risk of identity theft or fraud!
How to verify the legitimacy of any organization that calls or emails you.
Check for contact information. If the caller or emailer says they're with Microsoft, look for a physical address and the name of an actual person who works there.
Ask a friend or family member if they've heard of this company before--and if they haven't, hang up immediately!
Use Google to search for "company name scam" (where "company name" stands in for whatever business is supposedly calling you). If there are many results like this one from The New York Times: "Scam Alert: Don't Trust Those Who Claim To Be From Your Bank," then it's likely that something fishy is going on!
Don't click on links in emails, do this instead
Don't click the link if you receive an email from your bank, PayPal, or any other financial institution asking for your login details or additional personal information.
Bogus emails are designed to trick you into entering your credentials so that hackers can access them and use them to commit fraud. For example, suppose a hacker wants access to your account. In that case, they will try to make it look legitimate by using official logos and branding elements in their phishing emails. In addition, phishing emails often contain links that take users directly to their login page without entering any further details (see below). This makes it easier for hackers because they don't need as much information about their victims before they can begin exploiting them.
Never send money, credit card numbers, or passwords via email.
Social engineering is a form of hacking that relies on human behavior to gain access to information. This can include tricking someone into giving up their password, credit card number, or other sensitive data by pretending to be someone they trust.
Social engineers will often use email to communicate with potential victims because it's fast and easy for them--and less suspicious than phone calls or face-to-face meetings. But, unfortunately, they may also send you an attachment containing malware that can infect your computer when opened (more on this later).
If you receive an email asking for money or personal information--or even just something that looks like it could be significant--don't click on any links within the message; instead, open up another tab in your browser and type in "www" plus whatever domain name comes after "@" at the beginning of each URL address listed in the email (e.g., if there were two links listed at "www" followed by ".com" then enter www., then .com).
Do not discuss your personal information over the phone if you didn't initiate the call.
If you didn't initiate the call, hang up.
Never give out your personal information to a stranger over the phone. Caller ID can be easily faked. Even if it's not, social engineers will use other means of getting at your information by pretending they are someone else (like an employee from another department). If you feel as though you need to contact the company or person again, call them yourself instead of calling back on their number provided by someone who called you out of nowhere asking for personal details like social security numbers or birthdates!
Use spam filters and maintain security software on your computer and mobile devices updated regularly with the latest patches and updates.
You might be wondering, "What is social engineering?" Social engineering is a type of fraud that involves tricking people into giving up sensitive information or taking actions they wouldn't usually take. It's done by manipulating human emotions, such as fear and greed.
Social engineers often use phishing emails to get their victims to reveal personal information such as credit card numbers or account logins. If you receive an email from someone you don't know asking for your password or other sensitive information, delete it immediately! You can also report suspicious emails like this to your email provider so they can block similar messages from being sent in the future.
Use multifactor authentication for 99.9% protection.
Multifactor authentication is the best way to protect your logins and accounts. It's also called 2FA (two-factor authentication) or MFA (multifactor authentication).
What is multifactor authentication? Multifactor authentication requires you to use two or more types of information to log into an account. This commonly means entering a password plus something else, such as a code sent via SMS text message or generated by an app on your phone.
How do I enable it on my accounts? Many services offer the option to enable multifactor authentication; if they don't, contact customer support and ask why not! You can also use Google Authenticator or Authy instead of having codes texted directly from your bank or social media platform's servers. These apps generate their codes instead of sending them from someone else's computer network somewhere far away from where you are standing right now; reading this article about how awesome MFA is for protecting yourself against social engineering attacks like phishing scams that are so common among businesses today...
Be careful about clicking links or attachments in emails, texts, and social media messages, even from known sources.
When you receive an email or text message from a friend, family member, or colleague, it's easy to assume that the sender is who they say they are. This is because you know them and trust them. But scammers have become very good at creating fake email addresses that look legitimate and sending out phishing messages that appear to come from someone you know.
If you don't recognize the sender of an email message (or if there's any doubt), don't open any links in it! If someone sends you an attachment via email but doesn't give any context for why they sent it--for example: "Check out this photo!"--delete it immediately without opening anything else on your screen until after checking with whomever supposedly sent it first (and only then if they were behind this).
Be suspicious if you receive an email requesting personal information or requesting access to your computer.
If you receive an email asking for personal information or access to your computer, don't click any links in the email. Instead, go directly to the website mentioned in the message by typing it into your browser's address bar.
If someone sends you an attachment and asks that you open it on their behalf--don't do it! The attachment could contain malware designed to infect your computer as soon as it's opened. And if it doesn't contain malware? Well, maybe they want something else from their target: financial records, login credentials...you get the idea!
Don't trust people who request personal information via email either; this includes bank account numbers and passwords (which should never be sent over unencrypted connections). If someone asks for money via email but doesn't identify themselves clearly enough for you to verify their identity--don't send them anything!
Be cautious about taking action if you see an alert on your screen saying there's a problem with your device or account. Cybercriminals create these alerts but can be hard to distinguish from legitimate warnings.
Don't click on any links or attachments. Cybercriminals often create fake websites that look like the sites of legitimate companies, such as banks and credit card companies. They may also send you an email from someone you know who has been hacked and is using their account to send malicious emails. If you receive a suspicious email, do not click on any links or attachments!
Please don't give personal information over the phone or in person without verifying whom they say they are first by calling back at another number (like your own cell phone) or asking them for more information about themselves before giving away sensitive details such as your Social Security number, address, and bank account numbers.* * * *
The best way to protect yourself from social engineering attacks is by being aware of how cybercriminals operate so that you know what to look out for regarding phishing scams, vishing calls, and other social engineering tactics.
The best way to protect yourself from social engineering attacks is by being aware of how cybercriminals operate so that you know what to look out for regarding phishing scams, vishing calls, and other social engineering tactics.
Take action:
Use multifactor authentication for 99.9% protection against phishing emails and text messages designed to steal your password or personal information. You can do this by adding a second layer of security on top of passwords in Gmail/Google Drive/Google Docs/etc. by enabling 2-step verification (2SV). This means that whenever someone tries accessing your account from an unknown device or location, they will have to enter both their username/email address AND a code sent via text message before they can access anything sensitive inside the account (like private documents). 2SV makes it extremely hard for hackers because they need both pieces of information before logging into your account successfully - making them much less likely than without 2SV enabled, which would require them to know one piece!
. Don't click links in emails unless necessary; instead, go directly into websites through search queries or bookmarked pages so as not to expose yourself unnecessarily since many phishing scams work by tricking users into clicking on links within emails which lead straight back again onto pages controlled by hackers who then capture all kinds private data including passwords etcetera - after which all sorts nasty things could happen like identity theft amongst others...
Romance Scams
Romance scams occur when criminals create fake online identities to gain a victim's affection and trust. They then use the illusion of a romantic or close relationship to manipulate the victims into giving them money or personal information. Here are some examples of individual romance scams:
In one case reported to the FBI, a victim met someone online who claimed to be a US soldier stationed overseas. The scammer used photos of a real soldier to create a fake identity and convinced the victim to send money for various reasons, such as shipping personal belongings back to the US. In reality, the victim was sending money to a criminal organization based in West Africa.
Another common tactic used by romance scammers is to pretend to be wealthy and successful individuals looking for love. In one case reported to the FTC, a woman was scammed out of $2 million by a man who claimed to be a wealthy oil executive from Texas. The scammer convinced the victim to invest in his oil company and promised to pay her back with interest. In reality, the scammer was using the money to fund his luxurious lifestyle and never intended to pay the victim back.
Scammers can also use emotional manipulation to convince victims to send money. In one case reported to the FTC, a man was scammed out of $200,000 by a woman who claimed to be an overseas nurse. The scammer convinced the victim that she needed money for medical expenses and other emergencies, and the victim sent the money through gift cards and wire transfers.
In 2021, Brian Walshe, an American artist living in South Korea, fell victim to a scam involving a fake Gurifollo painting. Court documents reveal that Walshe was approached by a friend who offered to sell him the painting for $100,000. The friend claimed that the painting had been in his family for decades and that it was an original piece by the Italian artist Amedeo Modigliani. Walshe agreed to purchase the painting and wire-transferred the money to the friend's account but was later informed by the FBI that the painting was a fake.[1]
Walshe's case is not unique, as art fraud is a common practice in the art world. In 2020, a documentary titled "Made You Look" was released on Netflix, which tells the story of a fake painting scam that swindled the art world out of more than $80 million.
Here are three stories of retirees who fell victim to social engineering scams:
In 2019, a retired teacher from Michigan received a call from someone claiming to be her grandson, who said he was in trouble and needed money. The caller convinced her to withdraw $8,000 from her bank account and send it through FedEx. The package was intercepted by law enforcement, who were able to recover the money and return it to the retiree.
A retiree from Florida fell victim to a sweepstakes scam in which she was told she had won a large sum of money but needed to pay a fee to receive her winnings. Over the course of several months, the retiree sent over $100,000 to scammers. She eventually realized it was a scam and reported it to the authorities, but was unable to recover her lost money.
A retired couple from California received a call from someone who claimed to be a representative from Microsoft, saying that their computer was infected with a virus. The caller convinced the couple to give them remote access to their computer and charged them $500 to fix the issue. The couple later discovered that the caller had installed malware on their computer and stolen personal information.
In 2020, Shark Tank television judge Barbara Corcoran was tricked in a social engineering scam and lost almost $400,000. A cybercriminal impersonated her assistant and sent an email to the bookkeeper requesting a renewal payment related to real estate investments. The email included a fake invoice with the attacker's bank account details. By the time Corcoran's team realized the scam, it was too late to recover the funds. [1]
In 2019, a small business owner in the UK lost £25,000 ($34,000) to a phone scammer who pretended to be from her bank's fraud department. The scammer convinced the business owner to transfer her money to a "safe account" due to fraudulent activity on her account. The victim didn't realize the scam until it was too late. [2]
In 2018, a Texas school district lost $2.3 million to a phishing scam. The attackers used social engineering tactics to trick the district's staff into transferring funds to their accounts. The attackers posed as a construction company doing business with the district and sent fake invoices and emails that looked like they came from the company. The district didn't realize the scam until it was too late to recover the funds. [3]
Sources:
https://gatefy.com/blog/real-and-famous-cases-social-engineering-attacks/
https://www.nbcnews.com/news/us-news/texas-school-district-loses-2-3m-phishing-scam-n904511
https://craigpeterson.com/cyber-breaches/phishing/smishing/social-engineering-comes-to-the-forefront-of-attacks/36588/
https://craigpeterson.com/computers/security/petya-victims-told-not-to-pay-ransom-as-hackers-are-no-longer-able-to-unlock-victims-computers/12752/
Join thousands of security professionals who receive Craig Peterson's Insider Show Notes and cybersecurity updates.