# data[].attributes.headline
10 real and famous cases of social engineering attacks

# data[].attributes.subject
10 real and famous cases of social engineering attacks

# data[].attributes.attachment_link.title
10 real and famous cases of social engineering attacks - Gatefy

# data[].attributes.attachment_link.description
Social engineering is a cyber scam to gain your trust and steal your data and money. Check out our list of famous social engineering cases.

# data[].attributes.headline
Social Engineering Attacks: A Look at Social Engineering Examples in Action

# data[].attributes.subject
Social Engineering Attacks: A Look at Social Engineering Examples in Action

# data[].attributes.attachment_link.readable_text
Social engineering is a commonly used tactic that was used in 33% of data breaches in 2018, according to Verizon's 2019 Data Breach Investigation Report - here's what social engineering hacking looks like in real life

My mom used to always joke that if you left my dad alone with a stranger, he could find out that person's underwear size within a matter of minutes. He's someone who's extremely intelligent, fun, engaging, and has always had a knack for making people feel comfortable and open up to. Frankly, if my dad had the desire to carry out social engineering attacks - and was a schmuck that enjoyed ripping people off - he'd make a great social engineer.

Thankfully, that's not the case, and my dad doesn't have the technical know-how to craft believable phishing emails or to create malicious websites (after all, this is the same man who argues with Siri on a daily basis). But just because my dad doesn't have the technical know-how (or interest) to engage in such activities doesn't mean that there aren't others who don't or wouldn't be willing to do so - namely cybercriminals.

So, what are social engineering attacks and why are they so successful? We'll take a look at the definition of social engineering, walk you through why social engineering hacking is such an effective method of attack for hackers, and show you a few key social engineering examples.

Let's hash it out.

What Is Social Engineering?

Social engineering is, hands down, one of the most dangerous threats to businesses and individuals alike. In a nutshell, a social engineer is someone who uses social interactions with individuals to either get something from you (such as your password) or get you to do something (like make a wire payment). They may be disarming in their approach and make you feel comfortable, or they may present themselves as someone of authority and convey a sense of urgency.

Either way, social engineering attacks are about getting you to like and trust them, or to make you feel like they're a person of authority and you must comply with whatever they ask for.

Imperva, a world-renowned cybersecurity organization, describes social engineering as:

[...] a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information."

Or, as the FBI puts it more succinctly, it's "targeted lies designed to get you to let your guard down." So, all of this is to say that social engineering attacks are cyber attacks that involve the use of social engineering tactics.

Types of Social Engineering Attacks

Social engineering attacks, which Verizon reports were used in 33% of the data breaches in 2018, can occur:

Via face-to-face interactions,

Over the phone (vishing, or what's known as voice phishing),

Over SMS text message phishing (smishing),

Using email phishing tactics (such as phishing), or

By using any combination of these and other avenues.

These types of attacks don't require a bunch of technical skills or hacking techniques. It's about "hacking" or exploiting a person rather than technology itself. However, using technology certainly makes pulling off these attacks a lot easier for the cybercriminals who use them.

Frank Abagnale, the world's most famous con man-turned-security consultant whose life and crimes were the basis of the movie "Catch Me If You Can," said in an interview with SearchCloudSecurity that while social engineering at its core is still the same, it's just that criminals are now using different methods of attack.

Some people used to say that I'm the father of social engineering. That's because when I was 16 years old, I found out everything I needed to know - I knew who to call and I knew the right questions to ask - but I only had the use of a phone. People are still doing the same things today 50 years later, only they're using the phone, they're using the mail system, they're using the internet, email, cloud. There's all this other stuff, but they're still just doing social engineering."

Social Engineering Attacks Is All About Getting to Know You

In the digital world, social engineering attacks involves cybercriminals learning as much information as they can about a company and a target individual (i.e. you). They then use that information to get you to do something you shouldn't (such as providing sensitive personal information or making a wire transfer).

Essentially, they treat you like a research project and learn about you through a variety of tactics, including:

Searching for information about you on Google and other search engines: The more they know about you, the easier it is to relate to you and make you trust them. This disarms you and makes you more likely to comply.

Tracking down your social media pages to learn about you: If a hacker knows what you pin on Pinterest, what you watch on YouTube, what groups you're a part of on Facebook, or even what photos you like on Instagram, etc., they can craft more believable phishing emails to trick you.

Seeing who you're connected to (via LinkedIn and your company website) and learning your organization's hierarchy: Cybercriminals want to make their jobs as easy as possible. If they know that you're Sally and you work as an accounts payable employee, and that your company typically works with Org X as a vendor, they might be able to get away with impersonating that organization to get you to make a fraudulent payment.

Going through your trash: No, I'm not speaking metaphorically here. I meant that literally. Some social engineers have been known to go dumpster diving to gain valuable information about you or your organization. This is an example of why it's important to properly dispose of personal, proprietary, or otherwise sensitive information.

Breaking Down the Social Engineering Attack Life Cycle

To talk about the lifecycle of a social engineering attack, we're going to use the terms as identified by Imperva. The social engineering life cycle includes four distinct phases. These types of attacks include one or more of these steps:

1. Investigation: This step is all about research and gathering as much information about you and your company as possible.

2. Relationship Building: This next phrase is about using social tactics and psychology to manipulate or deceive you. Armed with knowledge about you and your organization, they'll reach out to develop a connection and to engage with you.

3. Play: This next step is when they really put the plan into motion to exploit the interaction. It's about expanding their influence on you to get you to provide information or to perform an action.

4. Exit: This is where they take a moment to get rid of evidence - to wipe away their digital fingerprints, metaphorically speaking - to make their getaway and get the hell out of dodge (ideally, without you even knowing that something's wrong until after they're long gone).

How Social Engineering Attacks Occur

As you've learned, social engineering involves a malicious actor researching you and your organization to learn about you so they can use that information to dupe you into sharing information or doing something that you shouldn't.

Social engineering isn't an impatient man's game. Unlike traditional phishing attacks, which can involve sending out mass emails to thousands of people with the hope of tracking even just one into clicking on a malicious link, social engineering attacks are more targeted. Cybercriminals can spend a few hours or even days, weeks, or months preparing to make their move.

So, how does one of these attacks occur? Often times, it boils down to finding the right person to target and finding - or creating - the right opportunity.

According to Abagnale in an interview with WIRED:

Every case involving cybercrime that I've been involved in, I've never found a master criminal sitting somewhere in Russia or Hong Kong or Beijing. It always ends up that somebody at the company did something they weren't supposed to do. They read an email, went to a website they weren't supposed to. So they opened the door that allowed the person to get in. It's not that these people are that talented but they wait knowing that with a company of 10,000 employees someone is bound to open the door. They just wait for that door to be open."

Not sure what we mean? Let's dig a little deeper.

An Example of Social Engineering in Action

Let's imagine that you're an accounts payable employee named Tina. You're sitting at your workstation when, suddenly, you get a call from Drew Stevens, a representative at one of your company's vendors. He tells you that there's an issue with the last payment that was made, saying that they never received it.

You feel mortified. While you're apologizing and quickly try to find the receipt from the last payment, Drew continues talking, reassuring you that it's fine but that they really do need the payment to be made quickly if your company is to continue using their services. He continues on, saying that it was probably just a hiccup with the paperwork - that their company recently changed banks and sent the updated payment info to all of their customers, yet, somehow, the new bank account info never seemed to make it to you and another customer.

He sighs but laughs, saying it's just one of those things. Technology, right? Gotta love it.

He's friendly, confident, charming, and understanding. He reassuringly says that he doesn't want to make additional work for you because they know you're probably already so swamped! So, to make it easy, he's just sent you the new banking info and would really appreciate it if you could go ahead and make the payment ASAP so your organization's service doesn't lapse.

You check your email, and there's a message waiting from Drew, just like he said. In it, there's an invoice attached. You open it immediately and use the information in the doc to go ahead and make the payment.

Drew thanks you and tells you that he's received the payment. He smoothly wraps up the conversation, telling you that he's going to go ahead and sent a receipt for the payment and that he's glad you both were able to work together to rectify the situation so quickly. You exchange goodbyes and hang up.

A few weeks later, your boss comes in to ask about the payment to this unknown account. You tell him that you were being proactive and wanted to take care of the situation quickly by making the payment.

But the payment was already made, your boss says, and it turns out that the company just suffered a data breach that was tracked back to your workstation.

Say what?!

What you didn't know is that the invoice you opened from Drew was actually a malicious file. Now, not only have you sent a payment to a fraudulent account, but you've also opened up your company's network and IT systems to a hacker.

See Social Engineering Attacks in Action for Yourself

All of this just sounds too obvious, right? There's no way that someone could be fooled by something so simple. Unfortunately, that's not the case. Nearly two in 10 people fall for these attacks all the time.

Want to see some real-life "people hackers" in action? Watch as social engineer David Kennedy tricks a company into providing credit card information. He spoofs his phone number to make it appear as though he's calling from inside the company.

Here's another example of how effectively a social engineer can hack people. In this video, social engineer Jessica Clark uses vishing (voice phishing/voice solicitation) to get the Real Future video host Kevin Roose's cell phone provider to give her Roose's email address. But she doesn't stop there:

Here's an example from the same video of Dan Tentler, a hacker who used social engineering tactics to track down Roose's SquareSpace blog. Tentler uses this information to craft an effective spear phishing email, which gains him access to the host's 1Password key chain.

What You Can Do to Prevent Social Engineering Attacks

Unsurprisingly, technology has made pulling off social engineering crimes significantly easier for the criminals - but that doesn't mean that the outlook is hopeless.

In the interview with SearchCloudSecurity that we mentioned earlier, Abagnale recommends the following approach for organizations, businesses, and individuals alike:

So technology has made things a lot easier, and all criminals have done is conform to that. The important thing is this: You can't develop technology and say, 'Here's my foolproof technology, you can't beat it, goodbye.' You have to constantly go back and stay on top of it all the time. You can't just develop it and walk away and be done with it. You have to constantly be aware of things that can happen to it and how people are going to try to beat it."

In other words, to fight against social engineering attacks, your company needs to:

Harden your tech defenses with network and IT security best practices

Secure any servers and databases and ensure your data is encrypted

Implement cyber security awareness training for your employees

Encourage your employees to follow cyber security and email security best practices

Limit access to sensitive data and systems to only those employees whose jobs require it

Implement secondary verification procedures before wiring any payments or making changes to vendor information

Final Thoughts on Social Engineering Attacks

Criminals, in one form or another, are nothing new. The same can be said about social engineering and social engineering attacks. While it may adapt and change over time in terms of how it's performed, the same general concept is still the same. This is why it's so important for organizations to inform their employees about these types of threats, so they can recognize them for what they are and not be taken for a ride.

So, while a social engineer or cybercriminal likely has no interest in discovering your underwear size, they certainly do want to learn whatever they can about you in other areas so they can use that information to put you at ease and get you to do something you shouldn't.

# data[].attributes.attachment_link.title
Social Engineering Attacks: A Look at Social Engineering Examples in Action - Hashed Out by The SSL Store™

# data[].attributes.attachment_link.description
My mom used to always joke that if you left my dad alone with a stranger, he could find out that person's underwear size within a matter of minutes. He's someone who's extremely intelligent, fun, engaging, and has always had a knack for making people feel comfortable and open up to.

# data[].attributes.attachment_link.readable_text
We're constantly telling our employees to look out for social engineering attacks , but while we can share definitions all day long, humans often learn best by example.

By seeing real phishing emails, hearing stories of clever pretexts and watching live hacking demonstrations, we can bring our teams one step closer to truly understanding the big buzzword "social engineering."

Here are a few specific examples of what popular social engineering schemes really look like:

1. Spear Phishing Emails, Calls or Texts

Phishing is a term used to describe cyber criminals who "fish" for information from unsuspecting users. Some hackers send out mass messages, casting a wide net and hoping to trick a large pool of recipients. These generic messages, however, are often easy to spot for the scams they are.

To weave a more convincing story, most versed cyber criminals research and obtain deep knowledge about their target- one "phish" at a time. Like a spear fisherman stabs at a single fish, spear phishers oftentimes only bait one particular person per attack.

There are numerous types of spear phishing, all with their own slight variations in naming, but three of the most common are emails, phone calls and SMS messages.
FUN FACT: Phishing is likely an evolution from the word "phreaking," which is commonly used in the hacking community to describe people who study telecommunication systems, such as phones, and weave clever social engineering pretexts over them. It uses the "ph" from "phreaking" to play off the word "fishing."
Phishing Emails

These are emails sent with malicious intent, containing links or attachments that download malware onto your device. We've all received scam emails, but some aren't as easy to spot! Social engineers can spoof email addresses to make it look like a message came from a boss or a trusted source.

Real-Life Example:
In the phishing email examples above from KnowBe4 , you can see how these social engineers asked for specific order numbers or payment transfers, digging for important information to use against you.

Voice Phishing (Vhishing)

Vhishing is a combination of "voice" and "phishing." It's the phone's version of email phishing, where a bad actor calls instead of emails to steal confidential information. These calls often leverage fear and urgency to get quick, impulsive callbacks.

These social engineers often imitate figureheads you've never actually talked to or met, so as to be sure you wouldn't recognize their voice!

Real-Life Example:
You get a voicemail message saying your car insurance is about to expire! You have to call back right away to renew your coverage before you go without it and get penalized. In reality, this is not your real car insurance provider- it's a scammer trying to get your credit card information during a fake renewal call.

SMS Phishing (Smishing)

Bad actors don't just leave deceptive voicemails; they are now also texting-savvy! Whether it's a work phone or your personal device, they're sending pointed SMS messages to phish.
Watch out for COVID-19 related phishing emails, calls and SMS messages right now. Bad actors are shamelessly capitalizing on fear around the virus to send infected links, masquerading as vaccine sign-ups, stimulus check deposits and more!
Real-Life Example:
These tricky phishing texts come in many forms. From a spoofed number imitating Google verifying your device (image from KnowBe4 ) to your "phone provider" telling you you're late on a payment with a linked payment portal to avoid a late fee, (wherein the hacker captures your login information or banking details), there are a few ways cybercriminals target your cell phone.
DID YOU KNOW? When a bad actor weaves a false story or situation using real facts to build trust and credibility this is called "pretexting." They are creating a fake narrative or pretext to get you to perform an action.
2. Baiting

In order to catch a fish, a fisherman would string some bait on a hook before casting their line. That's exactly what bad actors do in their messages! They dangle before you some juicy bait- often in the form of a coupon, money, a special prize, etc.

Real-Life Example:
Look out for those "Congrats, you won a gift card!" scams, like the screenshot we shared from KnowBe4 . These could also be emails that look like bonus payouts at the end of the year coming from a boss' spoofed address or even a message saying you received tracking for a package at work (when you weren't expecting a delivery that day!).

3. Quid Pro Quo

Whereas during a baiting attack the social engineer often offers an enticing deal or product, quid pro quo often involves a service offered in exchange for something. After all, it's named quid pro quo because the phrase is literally Latin for "something for something."
See what bad actors are actually up to by reading about some of the biggest social engineering attacks: 5 of the Most Famous SE Attacks of the Last Decade and The Biggest Social Engineering Attacks in History .
Real-Life Example:
Oftentimes a social engineer will pose as someone from the IT department, calling a user with a fake problem (i.e. we had a social engineering scam going around and are asking users to reset their passwords). The bad actor offers a temporary solution (reset your credentials and set a temporary password like "1234" for now, then go in and reset it to what you want later). With the person's username and new temporary password, the engineer gets into the account and resets it to something only they know- and has full access to their account seconds after the call.

4. Tailgating or Piggybacking

When you're on the road and another car is riding close behind you, you call it tailgating. Social engineers use this same principle. They follow closely behind employees entering a building to gain access- oftentimes, specifically to a restricted, fob/code-accessible area.

Real-Life Example: A bad actor may dress up as a delivery person juggling many packages or wearing a fake badge and fancy suit to look important. In the embedded video, you'll see that there are other social engineering hacking techniques they can use too, like hiding a device that clones your key fobs access number to get into a corporate office or building.

Beyond Social Engineering Attacks

Social engineering is one of the top two techniques used to compromise corporations, but these attacks aren't the only cyber threats out there.

Here are 5-½ truly impactful ways you can increase your digital security to get you started.

# data[].attributes.attachment_link.title
4 Social Engineering Attack Examples (with Pictures!)

# data[].attributes.attachment_link.description
We're constantly telling our employees to look out for social engineering attacks , but while we can share definitions all day long, humans often learn best by example. By seeing real phishing emails, hearing stories of clever pretexts and watching live hacking demonstrations, we can bring our teams one step closer to truly understanding the big buzzword "social engineering."

# data[].attributes.headline
9 Examples of Social Engineering Attacks

# data[].attributes.subject
9 Examples of Social Engineering Attacks

# data[].attributes.attachment_link.readable_text
All examples of social engineering take advantage of human nature, such as the willingness to trust others, to trick individuals into divulging sensitive information.

Despite its prevalence, social engineering can be challenging to distill into a single formula. It's one of the reasons 82% of data breaches involve the human element.

Social engineering has become the backbone of many cyber threats, from phishing emails to smishing and vishing attacks. This blog post will outline many popular social engineering techniques and the emotions hackers use to dupe their victims.

9 Most Common Examples of Social Engineering Attacks

In no particular order, here are nine common cyber threats that leverage social engineering tactics to gain access to sensitive information. While most of these attacks occur online, several can rear their heads in physical spaces like offices, apartment buildings, and cafes.

1. Phishing

The most pervasive way of implementing social engineering, hackers will use deceptive emails, websites, and text messages to steal sensitive personal or organizational information from unsuspecting victims.

Despite how well-known phishing email techniques are, 1 in 5 employees still click on those suspicious links

2. Spear Phishing

This email scam is used to carry out targeted attacks against individuals or businesses. Spear phishing is more intricate than your average mass phishing email, as it requires in-depth research on potential targets and their organizations

3. Baiting

This type of attack can be perpetrated online or in a physical environment. The cyber criminal usually promises the victim a reward in return for sensitive information or knowledge of its whereabouts.

4. Malware

A category of attacks that includes ransomware, victims are sent an urgently worded message and tricked into installing malware on their device(s).

Ironically, a popular tactic is telling the victim that malware has already been installed on their computer and that the sender will remove the software if they pay a fee.

5. Pretexting

This attack involves the perpetrator assuming a false identity to trick victims into giving up information. Pretexting is often leveraged against organizations with an abundance of client data, like banks, credit card providers, and utility companies.

6. Quid Pro Quo

This attack centers around an exchange of information or service to convince the victim to act. Normally, cyber criminals who carry out these schemes don't do advanced target research and offer to provide "assistance," assuming identities like tech support professionals.

7. Tailgating:

This attack targets an individual who can give a criminal physical access to a secure building or area. These scams are often successful due to a victim's misguided courtesy, such as if they hold the door open for an unfamiliar "employee."

8. Vishing

In this scenario, cyber criminals will leave urgent voicemails to convince victims they must act quickly to protect themselves from arrest or another risk. Banks, government agencies, and law enforcement agencies are commonly impersonated personas in vishing scams.

9. Water-Holing

This attack uses advanced social engineering techniques to infect a website and its visitors with malware. The infection is usually spread through a website specific to the victims' industry, like a popular website that's visited regularly.

How Does Social Engineering Happen?

Social engineering happens because of the human instinct of trust. Cyber criminals have learned that a carefully worded email, voicemail, or text message can convince people to transfer money, provide confidential information, or download a file that installs malware on the company network.

Consider this example of spear phishing that convinced an employee to transfer $500,000 to a foreign investor:

1. Thanks to careful spear phishing research, the cyber criminal knows the company CEO is traveling.

2. An email is sent to a company employee that looks like it came from the CEO. There is a slight discrepancy in the email address, but the spelling of the CEO's name is correct.

3. In the email, the employee is asked to help the CEO by transferring $500,000 to a new foreign investor. The email uses urgent yet friendly language, convincing the employee that he will be helping both the CEO and the company.

4. The email stresses that the CEO would do this transfer herself, but she can't make the fund transfer in time to secure the foreign investment partnership since she is traveling.

5. Without verifying the details, the employee decides to act. He truly believes that he is helping the CEO, the company, and colleagues by complying with the email request.

6. A few days later, the victimized employee, CEO, and company colleagues realize they've been the targets of a social engineering attack, resulting in a loss of $500,000.

White Paper - How to Protect Your Data from Social Engineering

Learn how to detect common social engineering tactics and threats and protect confidential data from cybercriminals.

Examples of Social Engineering Attack Scenarios

Savvy cyber criminals know that social engineering works best when focusing on human emotion and risk. Taking advantage of human emotion is much easier than hacking a network or looking for security vulnerabilities.

The following are some familiar notes successful social engineering attacks hit again and again.

Fear

You receive a voicemail saying you're under investigation for tax fraud and must call immediately to prevent arrest and criminal investigation. This social engineering attack happens during tax season when people are already stressed about their taxes.

Cyber criminals prey on the stress and anxiety of filing taxes and use these fear emotions to trick people into complying with the voicemail.

Greed

Imagine if you could transfer $10 to an investor and see this grow into $10,000 without any effort on your behalf. Cyber criminals use the basic human emotions of trust and greed to convince victims that they really can get something for nothing.

A carefully worded baiting email tells victims to provide their bank account information, and the funds will be transferred the same day.

Curiosity

Cyber criminals pay attention to events capturing a lot of news coverage and then take advantage of human curiosity to trick social engineering victims into acting. For example, after the second Boeing MAX8 plane crash, cyber criminals sent emails with attachments that claimed to include leaked data about the crash.

The attachment installed a version of the Hworm RAT on the victim's computer.

Helpfulness

Humans want to trust and help one another. After researching a company, cyber criminals target two or three employees with an email that looks like it comes from the targeted individuals' manager.

The email asks them to send the manager the password for the accounting database-stressing that the manager needs it to ensure everyone gets paid on time.

The email tone is urgent, tricking the victims into believing they are helping their manager by acting quickly.

Urgency

You receive an email from customer support at an online shopping website that you frequently buy from, telling you they need to confirm your credit card information to protect your account.

The email language urges you to respond quickly to ensure that criminals don't steal your credit card information.

Without thinking twice, you send the information, which results in the recipient using your details to make thousands of dollars of fraudulent purchases.

How to Protect Your Information from Social Engineering Attacks

Though social engineering tactics are common, the examples in this blog post underscore how difficult they can be to spot and, more importantly, resist. Reacting based on human nature pushes many people toward a cyber criminal's desired outcome.

To safeguard against the prevalence of social engineering tactics, it's essential to arm yourself with the right tools and knowledge. Our Cyber Security Hub offers a comprehensive cyber security resource, including the latest information on social engineering threats.

By staying informed and empowered with our hub, you can proactively protect yourself and your sensitive data from malicious cyber attacks. Access our Cyber Security Hub for free today to secure your digital assets and stay ahead of potential threats.

Cyber Security Hub: Access Exclusive Cyber Security Content

Take advantage of our free Cyber Security Hub-it's your one-stop cyber security awareness and knowledge center with one-click access to our COVID-19 Kit, Work From Home Kit, Password Kit, Phishing Kit, and more.

# data[].attributes.attachment_link.title
9 Examples of Social Engineering Attacks | Terranova Security

# data[].attributes.attachment_link.description
Examples of social engineering include phishing, spear phishing, baiting, quid pro quo, vishing, pretexting, water-holing, tailgating, and...

# data[].attributes.headline
11 Examples of Social Engineering: Real-World Attacks

# data[].attributes.subject
11 Examples of Social Engineering: Real-World Attacks

# data[].attributes.attachment_link.title
15 Examples of Real Social Engineering Attacks - Updated 2023

# data[].attributes.attachment_link.description
Learn what social engineering is by exploring 15 examples of real social engineering attacks involving Google, Facebook, Twitter, and more.

# data[].attributes.body
A social engineering attack persuades the target to click on a link, open an attachment, install a program, or download a file. The link may redirect the target to a website that solicits personal information (that is then collected by the attacker) or has malware on it that then infects the target's computer.

# data[].attributes.attachment_link.authors[].name
Previous Blog PostIf We Keep Cutting Defense Spending, We Must Do Less

# data[].attributes.attachment_link.title
Social Engineering Explained: The Human Element in Cyberattacks

# data[].attributes.attachment_link.description
The human element is the most unpredictable factor in cybersecurity. A social engineer aims to make people do what they want or give the social engineer information, often without the person considering the negative consequences.

# data[].attributes.headline
5 Ways to prevent social engineering attacks

# data[].attributes.subject
5 Ways to prevent social engineering attacks

# data[].attributes.body
Think before you click
Research the sources
Email spoofing is ubiquitous
Don't download files you don't know
Offers and prizes are fake
Delete any request for personal information or passwords
Reject requests for help or offers of help
Set your spam filters to high
Secure your devices
Always be mindful of risks

# data[].attributes.attachment_link.title
5 Ways to Prevent Social Engineering Attacks

# data[].attributes.attachment_link.description
Social engineering, Tips and Tricks, Security, Cyber Security, Cybersecurity Awareness Month

# data[].attributes.body
In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization's network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.

# data[].attributes.attachment_link.readable_text
Do not give sensitive information to others unless you are sure that they are indeed who they claim to be and that they should have access to the information.

What is a social engineering attack?

In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization's network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.

What is a phishing attack?

Phishing is a form of social engineering. Phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization. For example, an attacker may send email seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers can use it to gain access to the accounts.

Phishing attacks may also appear to come from other types of organizations, such as charities. Attackers often take advantage of current events and certain times of the year, such as

Natural disasters (e.g., Hurricane Katrina, Indonesian tsunami)

Epidemics and health scares (e.g., H1N1, COVID-19)

Economic concerns (e.g., IRS scams)

Major political elections

Holidays

What is a vishing attack?

Vishing is the social engineering approach that leverages voice communication. This technique can be combined with other forms of social engineering that entice a victim to call a certain number and divulge sensitive information. Advanced vishing attacks can take place completely over voice communications by exploiting Voice over Internet Protocol (VoIP) solutions and broadcasting services. VoIP easily allows caller identity (ID) to be spoofed, which can take advantage of the public's misplaced trust in the security of phone services, especially landline services. Landline communication cannot be intercepted without physical access to the line; however, this trait is not beneficial when communicating directly with a malicious actor.

What is a smishing attack?

Smishing is a form of social engineering that exploits SMS, or text, messages. Text messages can contain links to such things as webpages, email addresses or phone numbers that when clicked may automatically open a browser window or email message or dial a number. This integration of email, voice, text message, and web browser functionality increases the likelihood that users will fall victim to engineered malicious activity.

What are common indicators of phishing attempts?

Suspicious sender's address. The sender's address may imitate a legitimate business. Cybercriminals often use an email address that closely resembles one from a reputable company by altering or omitting a few characters.

Generic greetings and signature. Both a generic greeting-such as "Dear Valued Customer" or "Sir/Ma'am"-and a lack of contact information in the signature block are strong indicators of a phishing email. A trusted organization will normally address you by name and provide their contact information.

Spoofed hyperlinks and websites. If you hover your cursor over any links in the body of the email, and the links do not match the text that appears when hovering over them, the link may be spoofed. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net). Additionally, cybercriminals may use a URL shortening service to hide the true destination of the link.

Spelling and layout. Poor grammar and sentence structure, misspellings, and inconsistent formatting are other indicators of a possible phishing attempt. Reputable institutions have dedicated personnel that produce, verify, and proofread customer correspondence.

Suspicious attachments. An unsolicited email requesting a user download and open an attachment is a common delivery mechanism for malware. A cybercriminal may use a false sense of urgency or importance to help persuade a user to download or open an attachment without examining it first.

How do you avoid being a victim?

Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.

Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information.

Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.

Don't send sensitive information over the internet before checking a website's security. (See Protecting Your Privacy for more information.)

Pay attention to the Uniform Resource Locator (URL) of a website. Look for URLs that begin with "https"-an indication that sites are secure-rather than "http."

Look for a closed padlock icon-a sign your information will be encrypted.

If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the request; instead, check previous statements for contact information. Information about known phishing attacks is also available online from groups such as the Anti-Phishing Working Group. (See the APWG eCrime Research Papers).

Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic. (See Understanding Firewalls for Home and Small Office Use, Protecting Against Malicious Code, and Reducing Spam for more information.)

Take advantage of any anti-phishing features offered by your email client and web browser.

Enforce multi-factor authentication (MFA). (See Supplementing Passwords for more information.)

What do you do if you think you are a victim?

If you believe you might have revealed sensitive information about your organization, report it to the appropriate people within the organization, including network administrators. They can be alert for any suspicious or unusual activity.

If you believe your financial accounts may be compromised, contact your financial institution immediately and close any accounts that may have been compromised. Watch for any unexplainable charges to your account.

Immediately change any passwords you might have revealed. If you used the same password for multiple resources, make sure to change it for each account, and do not use that password in the future.

Watch for other signs of identity theft. (See Preventing and Responding to Identity Theft for more information.)

Consider reporting the attack to the police, and file a report with the Federal Trade Commission.

# data[].attributes.attachment_link.authors[].name
Authors Cybersecurity and Infrastructure Security Agency (CISA)

# data[].attributes.attachment_link.title
Avoiding Social Engineering and Phishing Attacks | CISA

# data[].attributes.attachment_link.description
What is a social engineering attack? In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair…

# data[].attributes.body
Phishing: Angler phishing, Business email compromise, Pharming, Spear phishing, Tabnabbing/reverse tabnabbing, Whaling/CEO fraud.
Baiting
Diversion theft
Honey trap
Smishing/SMS phishing
Pretexting
Quid pro quo
Scareware
Tailgating
Vishing/voice phishing
Water-holing/water hole

# data[].attributes.attachment_link.readable_text
What is social engineering?

As technological defences become more robust, cyber criminals are increasingly using social engineering techniques to exploit the weakest link in the security chain: people.

Social engineers use a variety of means - both online and offline - to con unsuspecting users into compromising their security, transferring money or giving away sensitive information.

According to Proofpoint's 2019 report The Human Factor, 99% of cyber attacks use social engineering techniques to trick users into installing malware.

This page outlines the different types of social engineering threats targeting your organisation and explains how to defend against them.

Phishing

The most common form of social engineering attack is phishing.

Phishing attacks exploit human error to harvest credentials or spread malware, usually via infected email attachments or links to malicious websites.

Types of phishing attack include:

Other types of social engineering

There are more than phishing attacks to watch out for, however. Other social engineering tactics include:

How to defend against social engineering attacks

Mitigating the threat of social engineering is a critical component of all cyber security programmes.

It requires a multi-layered approach that combines staff training with technological defences, so that your employees can recognise and report social engineering attacks, and any successful attacks do as little damage as possible.

There are four essentials that your social engineering defences should cover:

1. A positive security culture

If you or your staff fall victim to a social engineering attack, your security team will need to act quickly to contain it. Your corporate culture must therefore encourage victims to report incidents as soon as possible.

The last thing you want is a malware infection that dwells on your system for months because the person who inadvertently caused it kept quiet for fear of getting into trouble.

2. Train your staff to learn the psychological triggers and other giveaways

Social engineering attacks are not always easy to detect, so it is important to understand the tactics they use, such as:

Masquerading as trusted entities, like familiar brands or people;

Creating a false sense of urgency to confuse victims, often by provoking them into a state of fear or excitement so they act quickly without thinking properly; and

Taking advantage of people's natural curiosity, sense of indebtedness or conditioned responses to authority.

You should train your staff to:

Be suspicious of unsolicited communications and unknown people;

Check whether emails genuinely come from their stated recipient (double-check senders' names and look out for giveaways such as spelling errors and other illiteracies);

Avoid opening suspicious email attachments;

Think before providing sensitive information;

Check websites' security before submitting information, even if they seem legitimate; and

Pay attention to URLs, and 'typosquatting' (sites that look genuine but whose web addresses are subtly different from the legitimate site they imitate).

Find out more about our cyber security staff awareness solutions
3. Test the effectiveness of the training

Training your staff should not be a one-off event. You should regularly test the effectiveness of the training and redeploy it as necessary.

For example, a simulated phishing attack - in which your staff are targeted by controlled phishing attempts - will show you how susceptible they are and how much your organisation is therefore at risk. With this information, you can retrain those who need it most, reducing your exposure.

Learn more about implementing an effective staff awareness programme

We can help you mitigate the risk of social engineering

IT Governance is a leading provider of IT governance, risk management and compliance solutions. Browse our range of staff awareness e-learning courses and social engineering solutions:

# data[].attributes.attachment_link.title
Types of social engineering attacks | IT Governance

# data[].attributes.attachment_link.description
As technological defences become more robust, cyber criminals are increasingly using social engineering techniques to exploit the weakest link in the security chain: people. Social engineers use a variety of means - both online and offline - to con unsuspecting users into compromising their security, transferring money or giving away sensitive information.

# data[].attributes.body
Social engineering is the art of manipulating people so they give up confidential information. The types of information these criminals are seeking can vary, but when individuals are targeted the criminals are usually trying to trick you into giving them your passwords or bank information, or access your computer to secretly install malicious software–that will give them access to your passwords and bank information as well as giving them control over your computer.

# data[].attributes.attachment_link.readable_text
Social engineering is the art of manipulating people so they give up confidential information. The types of information these criminals are seeking can vary, but when individuals are targeted the criminals are usually trying to trick you into giving them your passwords or bank information, or access your computer to secretly install malicious software-that will give them access to your passwords and bank information as well as giving them control over your computer.

Criminals use social engineering tactics because it is usually easier to exploit your natural inclination to trust than it is to discover ways to hack your software. For example, it is much easier to fool someone into giving you their password than it is for you to try hacking their password (unless the password is really weak).

Security is all about knowing who and what to trust. It is important to know when and when not to take a person at their word and when the person you are communicating with is who they say they are. The same is true of online interactions and website usage: when do you trust that the website you are using is legitimate or is safe to provide your information?

Ask any security professional and they will tell you that the weakest link in the security chain is the human who accepts a person or scenario at face value. It doesn't matter how many locks and deadbolts are on your doors and windows, or if have guard dogs, alarm systems, floodlights, fences with barbed wire, and armed security personnel; if you trust the person at the gate who says he is the pizza delivery guy and you let him in without first checking to see if he is legitimate you are completely exposed to whatever risk he represents.

What Does a Social Engineering Attack Look Like?

Email from a friend

If a criminal manages to hack or socially engineer one person's email password they have access to that person's contact list-and because most people use one password everywhere, they probably have access to that person's social networking contacts as well.

Once the criminal has that email account under their control, they send emails to all the person's contacts or leave messages on all their friend's social pages, and possibly on the pages of the person's friend's friends.

Taking advantage of your trust and curiosity, these messages will:

Contain a link that you just have to check out-and because the link comes from a friend and you're curious, you'll trust the link and click-and be infected with malware so the criminal can take over your machine and collect your contacts info and deceive them just like you were deceived

Contain a download of pictures, music, movie, document, etc., that has malicious software embedded. If you download-which you are likely to do since you think it is from your friend-you become infected. Now, the criminal has access to your machine, email account, social network accounts and contacts, and the attack spreads to everyone you know. And on, and on.

Email from another trusted source

Phishing attacks are a subset of social engineering strategy that imitate a trusted source and concoct a seemingly logical scenario for handing over login credentials or other sensitive personal data. According to Webroot data, financial institutions represent the vast majority of impersonated companies and, according to Verizon's annual Data Breach Investigations Report, social engineering attacks including phishing and pretexting (see below) are responsible for 93% of successful data breaches.

Using a compelling story or pretext, these messages may:

Urgently ask for your help. Your 'friend' is stuck in country X, has been robbed, beaten, and is in the hospital. They need you to send money so they can get home and they tell you how to send the money to the criminal.

Use phishing attempts with a legitimate-seeming background. Typically, a phisher sends an e-mail, IM, comment, or text message that appears to come from a legitimate, popular company, bank, school, or institution.

Ask you to donate to their charitable fundraiser, or some other cause. Likely with instructions on how to send the money to the criminal. Preying on kindness and generosity, these phishers ask for aid or support for whatever disaster, political campaign, or charity is momentarily top-of-mind.

Present a problem that requires you to "verify" your information by clicking on the displayed link and providing information in their form. The link location may look very legitimate with all the right logos, and content (in fact, the criminals may have copied the exact format and content of the legitimate site). Because everything looks legitimate, you trust the email and the phony site and provide whatever information the crook is asking for. These types of phishing scams often include a warning of what will happen if you fail to act soon because criminals know that if they can get you to act before you think, you're more likely to fall for their phishing attempt.

Notify you that you're a 'winner.' Maybe the email claims to be from a lottery, or a dead relative, or the millionth person to click on their site, etc. In order to give you your 'winnings' you have to provide information about your bank routing so they know how to send it to you or give your address and phone number so they can send the prize, and you may also be asked to prove who you are often including your social security number. These are the 'greed phishes' where even if the story pretext is thin, people want what is offered and fall for it by giving away their information, then having their bank account emptied, and identity stolen.

Pose as a boss or coworker. It may ask for an update on an important, proprietary project your company is currently working on, for payment information pertaining to a company credit card, or some other inquiry masquerading as day-to-day business.

Baiting scenarios

These social engineering schemes know that if you dangle something people want, many people will take the bait. These schemes are often found on Peer-to-Peer sites offering a download of something like a hot new movie, or music. But the schemes are also found on social networking sites, malicious websites you find through search results, and so on.

Or, the scheme may show up as an amazingly great deal on classified sites, auction sites, etc.. To allay your suspicion, you can see the seller has a good rating (all planned and crafted ahead of time).

People who take the bait may be infected with malicious software that can generate any number of new exploits against themselves and their contacts, may lose their money without receiving their purchased item, and, if they were foolish enough to pay with a check, may find their bank account empty.

Response to a question you never had

Criminals may pretend to be responding to your 'request for help' from a company while also offering more help. They pick companies that millions of people use such as a software company or bank. If you don't use the product or service, you will ignore the email, phone call, or message, but if you do happen to use the service, there is a good chance you will respond because you probably do want help with a problem.

For example, even though you know you didn't originally ask a question you probably a problem with your computer's operating system and you seize on this opportunity to get it fixed. For free! The moment you respond you have bought the crook's story, given them your trust and opened yourself up for exploitation.

The representative, who is actually a criminal, will need to 'authenticate you', have you log into 'their system' or, have you log into your computer and either give them remote access to your computer so they can 'fix' it for you, or tell you the commands so you can fix it yourself with their help-where some of the commands they tell you to enter will open a way for the criminal to get back into your computer later.

Creating distrust

Some social engineering, is all about creating distrust, or starting conflicts; these are often carried out by people you know and who are angry with you, but it is also done by nasty people just trying to wreak havoc, people who want to first create distrust in your mind about others so they can then step in as a hero and gain your trust, or by extortionists who want to manipulate information and then threaten you with disclosure.

This form of social engineering often begins by gaining access to an email account or another communication account on an IM client, social network, chat, forum, etc. They accomplish this either by hacking, social engineering, or simply guessing really weak passwords.

The malicious person may then alter sensitive or private communications (including images and audio) using basic editing techniques and forwards these to other people to create drama, distrust, embarrassment, etc. They may make it look like it was accidentally sent, or appear like they are letting you know what is 'really' going on.

Alternatively, they may use the altered material to extort money either from the person they hacked or from the supposed recipient.

There are literally thousands of variations to social engineering attacks. The only limit to the number of ways they can socially engineer users through this kind of exploit is the criminal's imagination. And you may experience multiple forms of exploits in a single attack. Then the criminal is likely to sell your information to others so they too can run their exploits against you, your friends, your friends' friends, and so on as criminals leverage people's misplaced trust.

Don't become a victim

While phishing attacks are rampant, short-lived, and need only a few users to take the bait for a successful campaign, there are methods for protecting yourself. Most don't require much more than simply paying attention to the details in front of you. Keep the following in mind to avoid being phished yourself.

Tips to Remember:

Slow down. Spammers want you to act first and think later. If the message conveys a sense of urgency or uses high-pressure sales tactics be skeptical; never let their urgency influence your careful review.

Research the facts. Be suspicious of any unsolicited messages. If the email looks like it is from a company you use, do your own research. Use a search engine to go to the real company's site, or a phone directory to find their phone number.

Don't let a link be in control of where you land. Stay in control by finding the website yourself using a search engine to be sure you land where you intend to land. Hovering over links in email will show the actual URL at the bottom, but a good fake can still steer you wrong.

Email hijacking is rampant. Hackers, spammers, and social engineers taking over control of people's email accounts (and other communication accounts) has become rampant. Once they control an email account, they prey on the trust of the person's contacts. Even when the sender appears to be someone you know, if you aren't expecting an email with a link or attachment check with your friend before opening links or downloading.

Beware of any download. If you don't know the sender personally AND expect a file from them, downloading anything is a mistake.

Foreign offers are fake. If you receive an email from a foreign lottery or sweepstakes, money from an unknown relative, or requests to transfer funds from a foreign country for a share of the money it is guaranteed to be a scam.

Ways to Protect Yourself:

Delete any request for financial information or passwords. If you get asked to reply to a message with personal information, it's a scam.

Reject requests for help or offers of help. Legitimate companies and organizations do not contact you to provide help. If you did not specifically request assistance from the sender, consider any offer to 'help' restore credit scores, refinance a home, answer your question, etc., a scam. Similarly, if you receive a request for help from a charity or organization that you do not have a relationship with, delete it. To give, seek out reputable charitable organizations on your own to avoid falling for a scam.

Set your spam filters to high. Every email program has spam filters. To find yours, look at your settings options, and set these to high-just remember to check your spam folder periodically to see if legitimate email has been accidentally trapped there. You can also search for a step-by-step guide to setting your spam filters by searching on the name of your email provider plus the phrase 'spam filters'.

Secure your computing devices. Install anti-virus software, firewalls, email filters and keep these up-to-date. Set your operating system to automatically update, and if your smartphone doesn't automatically update, manually update it whenever you receive a notice to do so. Use an anti-phishing tool offered by your web browser or third party to alert you to risks.

Webroot's threat database has more than 600 million domains and 27 billion URLs categorized to protect users against web-based threats. The threat intelligence backing all of our products helps you use the web securely, and our mobile security solutions offer secure web browsing to prevent successful phishing attacks.

# data[].attributes.attachment_link.title
What is Social Engineering? Examples and

# data[].attributes.attachment_link.description
Social engineering is the art of manipulating people so they give up confidential information, which includes your passwords, bank information, or access to your computer. Follow this guide to learn the different types of social engineering and how to prevent becoming a victim.