# data[].attributes.headline
How does the social engineering piece intertwine with the technical aspect of cyber attacks?

# data[].attributes.subject
How does the social engineering piece intertwine with the technical aspect of cyber attacks?

# data[].attributes.attachment_link.readable_text
What is social engineering

Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.

Social engineering attacks happen in one or more steps. A perpetrator first investigates the intended victim to gather necessary background information, such as potential points of entry and weak security protocols, needed to proceed with the attack. Then, the attacker moves to gain the victim's trust and provide stimuli for subsequent actions that break security practices, such as revealing sensitive information or granting access to critical resources.

What makes social engineering especially dangerous is that it relies on human error, rather than vulnerabilities in software and operating systems. Mistakes made by legitimate users are much less predictable, making them harder to identify and thwart than a malware-based intrusion.

Social engineering attack techniques

Social engineering attacks come in many different forms and can be performed anywhere where human interaction is involved. The following are the five most common forms of digital social engineering assaults.

Baiting

As its name implies, baiting attacks use a false promise to pique a victim's greed or curiosity. They lure users into a trap that steals their personal information or inflicts their systems with malware.

The most reviled form of baiting uses physical media to disperse malware. For example, attackers leave the bait-typically malware-infected flash drives-in conspicuous areas where potential victims are certain to see them (e.g., bathrooms, elevators, the parking lot of a targeted company). The bait has an authentic look to it, such as a label presenting it as the company's payroll list.

Victims pick up the bait out of curiosity and insert it into a work or home computer, resulting in automatic malware installation on the system.

Baiting scams don't necessarily have to be carried out in the physical world. Online forms of baiting consist of enticing ads that lead to malicious sites or that encourage users to download a malware-infected application.

Scareware

Scareware involves victims being bombarded with false alarms and fictitious threats. Users are deceived to think their system is infected with malware, prompting them to install software that has no real benefit (other than for the perpetrator) or is malware itself. Scareware is also referred to as deception software, rogue scanner software and fraudware.

A common scareware example is the legitimate-looking popup banners appearing in your browser while surfing the web, displaying such text such as, "Your computer may be infected with harmful spyware programs." It either offers to install the tool (often malware-infected) for you, or will direct you to a malicious site where your computer becomes infected.

Scareware is also distributed via spam email that doles out bogus warnings, or makes offers for users to buy worthless/harmful services.

Pretexting

Here an attacker obtains information through a series of cleverly crafted lies. The scam is often initiated by a perpetrator pretending to need sensitive information from a victim so as to perform a critical task.

The attacker usually starts by establishing trust with their victim by impersonating co-workers, police, bank and tax officials, or other persons who have right-to-know authority. The pretexter asks questions that are ostensibly required to confirm the victim's identity, through which they gather important personal data.

All sorts of pertinent information and records is gathered using this scam, such as social security numbers, personal addresses and phone numbers, phone records, staff vacation dates, bank records and even security information related to a physical plant.

Phishing

As one of the most popular social engineering attack types, phishing scams are email and text message campaigns aimed at creating a sense of urgency, curiosity or fear in victims. It then prods them into revealing sensitive information, clicking on links to malicious websites, or opening attachments that contain malware.

An example is an email sent to users of an online service that alerts them of a policy violation requiring immediate action on their part, such as a required password change. It includes a link to an illegitimate website-nearly identical in appearance to its legitimate version-prompting the unsuspecting user to enter their current credentials and new password. Upon form submittal the information is sent to the attacker.

Given that identical, or near-identical, messages are sent to all users in phishing campaigns, detecting and blocking them are much easier for mail servers having access to threat sharing platforms.

Spear phishing

This is a more targeted version of the phishing scam whereby an attacker chooses specific individuals or enterprises. They then tailor their messages based on characteristics, job positions, and contacts belonging to their victims to make their attack less conspicuous. Spear phishing requires much more effort on behalf of the perpetrator and may take weeks and months to pull off. They're much harder to detect and have better success rates if done skillfully.

A spear phishing scenario might involve an attacker who, in impersonating an organization's IT consultant, sends an email to one or more employees. It's worded and signed exactly as the consultant normally does, thereby deceiving recipients into thinking it's an authentic message. The message prompts recipients to change their password and provides them with a link that redirects them to a malicious page where the attacker now captures their credentials.

Social engineering prevention

Social engineers manipulate human feelings, such as curiosity or fear, to carry out schemes and draw victims into their traps. Therefore, be wary whenever you feel alarmed by an email, attracted to an offer displayed on a website, or when you come across stray digital media lying about. Being alert can help you protect yourself against most social engineering attacks taking place in the digital realm.

Moreover, the following tips can help improve your vigilance in relation to social engineering hacks.

Don't open emails and attachments from suspicious sources - If you don't know the sender in question, you don't need to answer an email. Even if you do know them and are suspicious about their message, cross-check and confirm the news from other sources, such as via telephone or directly from a service provider's site. Remember that email addresses are spoofed all of the time; even an email purportedly coming from a trusted source may have actually been initiated by an attacker.

Use multifactor authentication - One of the most valuable pieces of information attackers seek are user credentials. Using multifactor authentication helps ensure your account's protection in the event of system compromise. Imperva Login Protect is an easy-to-deploy 2FA solution that can increase account security for your applications.

Be wary of tempting offers - If an offer sounds too enticing, think twice before accepting it as fact. Googling the topic can help you quickly determine whether you're dealing with a legitimate offer or a trap.

Keep your antivirus/antimalware software updated - Make sure automatic updates are engaged, or make it a habit to download the latest signatures first thing each day. Periodically check to make sure that the updates have been applied, and scan your system for possible infections.

# data[].attributes.attachment_link.title
What is Social Engineering | Attack Techniques & Prevention Methods | Imperva

# data[].attributes.attachment_link.description
Social engineering uses psychological manipulation to trick users into making security mistakes or giving away sensitive information

# data[].attributes.attachment_link.readable_text
The head of finance has just received an email from the CEO: "I'm heading out of town and will be out of reach for the next several hours, but we need to make a wire transfer asap to bank account #XXXXXXX."

This is a Business Email Compromise (BEC) scam, a type of financial fraud designed to steal money from businesses and individuals. The CEO's email account has been compromised--via a keylogger or social engineering--and the head of finance should flag the message for IT, not call the bank.

Attackers use phishing, social engineering and other hacking tactics to convince employees with access to company finances to make wire transfers into criminals' bank accounts. Typically, an attacker will impersonate high-level executives at a company (like a CEO or CFO) and send phishing emails to employees requesting either a money transfer or sensitive data that can be used to commit fraud.

By researching publicly available information on the corporate hierarchy, staff, and payment patterns, attackers were able to craft a convincing email that appeared to come from the company's CEO.

According to the FBI, more than $12 billion in domestic and international loss between October 2013 and May 2018 were due to BEC scams. Earlier this year, Department of Homeland Security, the Department of Treasury, and the U.S. Postal Inspection Service arrested 74 people in the United States, Nigeria, Canada, Mauritius and Poland as part of Operation WireWire. As part of the takedown, federal law enforcement seized nearly $2.4 million and recovered $14 million in fraudulent wire transfers.

A real-world example of a BEC attack involves Xoom Corporation, an online, international wire-transfer provider based in California. Spoofed emails sent to their finance department resulted in a transfer of $30.8 million to fraudulent overseas accounts.

Another incident targeting the U.S. toymaker Mattel resulted in a $3 million wire transfer to Chinese hackers that was eventually recovered. This involved a spear phishing email sent to a finance executive that approved large cash transfers. By researching publicly available information on the corporate hierarchy, staff, and payment patterns, attackers were able to craft a convincing email that appeared to come from the company's CEO.

Power Dynamics

Since the primary motivation of BEC attacks is to get money, attackers research the organization to identify who to target (can make wire transfers) as well as who to impersonate (can make the request). Recent research of 3,000 BEC attacks from Barracuda Sentinel found that attackers typically impersonate CEOs 43 percent of the time, compared to CFOs, just 2 percent of the time.

Targets tend to be employees that report to leadership. While CEOs were targeted only about 2 percent of the time, CFOs made up 17 percent of the targets, and members of finance and human resources teams were targeted an equal number of times. The attackers try to make the recipients--frequently in IT, sales, marketing, and operations--nervous about questioning people that are senior to them on the organizational chart.

The CEO or CFO would be more likely to stop and ask why someone needs to go out of the normal chain of command for a wire transfer. Someone in middle management will be less likely to question the authority figure seeming to make that request.

Safeguarding Against BEC

The FBI's tips on protecting against a BEC scam can help prevent financial fraud or a data leak.

Verify email communication or requests over a different channel, such as in person or over the phone.

Use a second form of verification for wire fund transfers.

Flag emails with extensions similar to company email domain names.

Flag email communications where the reply email address is different from the from email address shown.

Targets tend to be employees that report to leadership.

The U.S. Chamber of Commerce has instructions for victims of BEC scams. Acting within one or two days means the company might be able to recover the stolen money.

# data[].attributes.attachment_link.title
That Email is Not From the CEO, It's a BEC Scam

# data[].attributes.attachment_link.description
A Business Email Compromise (BEC) scam is a type of financial fraud designed to steal money from businesses and individuals. If the email from the CEO says to transfer money ASAP, it's time to call IT, not the bank.

# data[].attributes.attachment_link.readable_text
Most cybercriminals are master manipulators, but that doesn't mean they're all manipulators of technology - some favor the art of human manipulation instead. Learn how different examples of social engineering work and the techniques to watch for. Then, install a trusted cybersecurity tool that can help you spot cyberattacks launched by social engineers and help you keep your personal data private.
Social engineering definition

Social engineering in cybersecurity is the practice of manipulating someone into giving up sensitive information, usually through exploiting human error or taking advantage of trust in digital communications.

How social engineering works

Social engineering works by building false trust, exploiting human error, and using persuasion to gain access to sensitive or confidential information. As with most cyber threats, social engineering schemes can come in many forms, but they all generally work the same way.

There are four basic steps to a successful social engineering attack:

1. Infiltration
The social engineer contacts their victims, often by impersonating a trustworthy source and using the information gathered about their victims to gain trust.

2. Exploitation
The social engineer uses persuasion to request information from their victims, such as contact information or even login details that they can use for fraudulent purposes.

3. Disengagement
After carrying out their attack, the social engineer abruptly breaks off communication with their victims.

Depending on the social engineering attack type, these steps could span a matter of hours to months. But no matter the time frame, knowing the signs of a social engineering attack can help you stop it.

How to spot a social engineering attack

If you receive a message from a stranger that feels random, too personal, or too good to be true it's likely the beginning of a social engineering attack. Unlike traditional cyberattacks where cybercriminals like to remain unnoticed, social engineers often communicate directly with their victims in plain sight.

Here are some common social engineering techniques to watch out for:

Emotional manipulation
Social engineers are great at stirring up specific emotions like fear, curiosity, or pity, so consider the cause of these emotional triggers before acting on them. If a complete stranger messages you with a sob story, it's likely a social engineering technique.

Urgent requests
Social engineers don't want you to think twice. That's why many social engineering attacks involve some type of urgency, such as a sweepstakes you need to enter immediately or cybersecurity software you need to download to wipe a supposed virus off your computer.

Offers that feel too good to be true
It's tempting to want to cash in on winning the lottery or go on a free cruise. But chances are that if the offer seems too good to be true, it is - it's probably a social engineering attack.

False or unproven identity
If you raise any suspicions with a potential social engineer and they're unable to prove their identity - perhaps they won't do a video call with you, for instance - chances are they're lying about who they are and what they want.

8 types of social engineering attacks + examples

Almost all cyberattacks have some form of social engineering involved. And many social engineering techniques also involve malware - malicious software that wreaks havoc on devices and potentially monitors your activity.

Here are some common forms of social engineering and examples, from in-person manipulation to annoying spam texts:

1. Scareware

As the name indicates, scareware is malware that aims to scare you into doing something fast. It often comes in the form of pop-ups or emails imploring you to act immediately to get rid of supposed viruses or malware on your device. In fact, if you act you might be downloading a computer virus or malware.

Scareware example - Imagine you're scrolling through your phone when you receive a message purporting to be from a popular messaging app telling you that the software version you're using is outdated and warning you against the dangers of not keeping your apps up to date. So, you click the provided link. But instead of the app being updated, your device is infected with malware.

2. Email hacking and contact spamming

It's in our nature to pay attention to messages from people we know. And social engineers know this all too well, commandeering email accounts and spamming contact lists with all types of social engineering threats.

Email hacking and contact spamming example - Your friend sends you an email with the subject, "Check out this site!" and you don't think twice before opening it. By hacking an email account, a social engineer can make contacts believe they're receiving emails from someone they know. Usually, the purpose is to spread malware or trick people into exposing their personal data.

3. Phishing

Phishing is one of the most common types of social engineering, and typically involves a cybercriminal sending an email or text message asking for private information or encouraging you to click on an infected link. Different types of phishing scams are commonly used together, or in tandem with other social engineering schemes, to create more sophisticated social engineering attacks.

Phishing scams also come in a few different delivery forms:

Email phishing is one of the most traditional phishing methods and is often spam sent to many people at once.

Vishing (voice phishing) is when a phisher calls or leaves a voicemail pretending to be from a trusted institution in hopes of gaining private information.

Smishing (SMS phishing) involves sending texts containing malicious links or probing for personal information.

URL phishing is when a phisher sends a link to a fake website that looks legitimate to the victim. When the victim clicks the link, they're asked to provide private details that can be harvested by the attacker.

In-session phishing occurs when a victim is actively signed into an account or platform and a fake pop-up appears asking them to sign in again or to provide other sensitive information. It usually occurs on sites that don't use https encryption.

Phishing example - Imagine you work for a big company, and you receive an email that appears to be from IT. The email asks you to change your login password immediately, but when you click the link provided, you're redirected to a fake site that collects your new login information.

4. DNS spoofing

Also known as cache poisoning, DNS spoofing is when a browser is manipulated so that website visitors are redirected to malicious websites bent on stealing sensitive information. DNS spoofing is when your cache is poisoned with these malicious redirects.

DNS spoofing example - A cybercriminal creates a convincing copycat site of an online marketplace. When users go to log in, they are rerouted to the fake site and enter their login details. By doing so, they've unwittingly shared their password and username with the cybercriminal.

5. Baiting

Baiting is a social engineering technique that involves dangling something desirable in front of a victim, and hoping they'll take the bait - like rare access to a confidential file. This occurs most often on peer-to-peer sites like social media, whereby someone might encourage you to download a video or music, but it's actually malware.

Baiting example - A social engineer leaves a USB stick that's loaded with malware in a public place. The USB is likely labeled in a compelling way - like "confidential" or "bonuses." A target picks up the device and plugs it into a computer to see what's on it, which loads the malware onto the device.

6. Pretexting

Pretexting is the use of an interesting pretext, or ploy, to capture someone's attention. Once the story hooks the person, the social engineer tries to trick the would-be victim into providing something of value. Oftentimes, the social engineer is impersonating a legitimate source.

Pretexting example - Let's say you receive an email naming you as the beneficiary of a will. The email requests your personal information to prove you're the actual beneficiary and to speed up the transfer of your inheritance. Instead, you're at risk of giving a con artist the ability to access and withdraw your funds.

7. Watering hole attacks

A watering hole attack is a social engineering attack that infects a single website with malware. The site is almost always a very popular one - a virtual watering hole, if you will - to ensure that the malware can reach as many victims as possible.

Watering hole attack example - In 2017, the Polish Financial Supervision Authority was the victim of a watering hole attack. In this social engineering attack, users from specific IP regions who visited the site were redirected to a custom exploit kit, which then installed malware onto the visitors' devices.

8. Quid pro quo

Quid pro quo means a favor for a favor, essentially "I give you this, and you give me that." In this type of social engineering attack, the victim coughs up sensitive information, like account logins or financial details, then the social engineer doesn't return their end of the bargain.

Quid pro quo example - Imagine you're on a gaming forum and on the lookout for a cheat code to pass a difficult level. You wire money to someone selling the code, but you never hear from them again and you don't get your code - you've fallen victim to a quid pro quo social engineering attack

How to protect against social engineering attacks: 15 tips

1. Avoid suspicious links and attachments.
Don't click links or open attachments that you aren't expecting - they could be infected with malware or lead you to malicious websites.

2. Use caution in online-only friendships.
If an online friend is asking you for favors and personal information, but they're unwilling to verify their identity - be cautious. It might be a social engineer.

3. Learn how to spot social engineering methods.
Remember the signs of social engineering and the different ways social engineering attacks can affect you.

4. Be skeptical.
If a promise, offer, or deal seems too good to be true, it probably is. Grandiose promises are a common method of social engineering.

5. Use two-factor authentication (2FA).
Enabling2FA on your online accounts can help keep your online data private and out of the hands of social engineers.

6. Set strict spam filters.
Enable email and textspam filters to catch potential phishing messages. Social engineers love using spam messages to trick many victims at once.

7. Keep your Wi-Fi network private.
Don't allow strangers to access your Wi-Fi network - you don't know what they could be up to and what information they're collecting.

8. Monitor your account activity closely.
If you notice unusual charges on your accounts, weird emails sent from your address, or other strange activity, change your passwords immediately.

Manipulation is a nasty tactic for someone to get what they want. Thankfully, social engineering attacks can be thwarted if you know how to spot the signs. But knowledge isn't the only way to protect yourself against social engineering attacks. Norton 360 Deluxe is an all-in-one cybersecurity solution that can help protect your devices, your data, and yourself from falling victim.

Ellie Farrier

Cybersecurity writer

Ellie Farrier is a Prague-based cybersecurity writer interested in how technology and society overlap, especially the impacts of device security. Previously, she worked as a technical writer, diving into product troubleshooting, how-to guides, and tech usability.

# data[].attributes.attachment_link.title
What is social engineering? Definition + protection tips

# data[].attributes.attachment_link.description
What is social engineering? It's a cyberattack aimed at tricking someone into divulging information or taking action. Learn more here.

# data[].attributes.attachment_link.title
This is how hackers hack you using simple social engineering