In the world of cyber security, cybercriminals use various attack methods. Many attacks look for vulnerabilities in networks, devices and databases, targeting flaws in technology development and implementation. For cybercriminals looking for a non-technical approach the focus shifts to humans, aiming to ‘hack’ human behaviour through social engineering.
What is social engineering?
Social engineering is the psychological manipulation of people into performing actions or divulging confidential information – essentially, tricking them into doing things they shouldn’t or normally wouldn’t do.
Cybercriminals use human psychology and take advantage of how our brain works to manipulate and deceive us into thinking the risky behaviour we are undertaking is actually safe or necessary. They build trust so we feel comfortable and introduce a sense of urgency to pressure us take action without taking the time to logically assess what is going on and discuss it with a trusted person.
The cybercriminal’s ultimate goal is to get our money or information to use for fraud, such as identity theft, industrial espionage and other criminal activities, or simply to disrupt the normal course of business.
What does it look like?
Social engineering attacks come in many different forms. They can be email (phishing), texts (smishing) or voice calls (vishing) and can use various tactics like impersonations (pretexting or quid pro quo attacks), false promises (baiting), romance (honeytraps), or more subtle approaches like infected or fake websites (waterhole attacks).
In many of these attacks there is often a premise that is used to get your attention and action such as:
- An offer or a special deal on a new service or rate plan.
- Your computer has been compromised and needs to be fixed.
- A family member is having an emergency and needs help.
- You have a tax bill that needs immediate payment, or you may be fined or go to jail
- A delivery is on hold until your personal information is confirmed.
- Your account was accessed, and you need to log in to verify all your personal information.
- An offer of travel rewards or a credit on your next bill
Cybercriminals often exploit emotions such as excitement, fear, stress or even embarrassment to manipulate their victims. In normal situations, people carefully assess situations and make logical choices. However, when emotions are triggered, our decision-making process becomes clouded, making us more vulnerable to their tactics. This gives them the advantage they want.
Who is the target?
Anyone can be a target but some tactics work better with specific audiences. For example, the ‘grandparents scam’ often targets seniors, where cybercriminals pose as a family member in need of immediate assistance. Those who frequently order online may be more susceptible to delivery scams.
How can I protect myself?
Remember, these attacks target people, so the best defense is a person who follows some basic guidelines and take simple steps.
- Never give out personal information until you are sure you know who you are dealing with. If you are not sure ask for proof, don’t take their word for it.
- Trust your instincts if you feel uncomfortable or if it seems too good to be true, stop any interaction
- Never make a rush decision in the heat of the moment
- Be highly suspicious of unusual requests like paying with gift cards / crypto currency or being told not to discuss with anyone
- Always talk with family or friends for advice
- Secure your accounts by using complex passwords and turning on Multi Factor Authentication
- Keep your software up to date (operating systems, firewalls, antivirus)
To learn more about how you can protect yourself online, we encourage you to read our other articles for more in-depth information.
- The importance of strong passwords
- Taking steps to protect your online accounts
- Protecting your digital footprint
- Emotions – the cornerstone of fraud
