In 2022, social engineering attacks were the leading cause of fraud. To protect your company, there are different types of social engineering attacks to watch out for. They all use of manipulation techniques so their victims commit an action they wouldn’t do otherwise. Keep reading to learn how to recognize the most dangerous types of social engineering attacks.
Trustpair blocks any financial effect of social engineering attacks by continuously controlling payments before they’re executed. Request a demo for more information!
6 types of social engineering attacks
Social engineering is also referred to as human hacking because it preys on human weaknesses to infiltrate an otherwise secure network. It’s easier for hackers than to try to breach cybersecurity defenses.
Below are 5 types of social engineering amongst the most dangerous.
More exist, but ultimately they’re all a variation of the same process that uses:
- Disguise: Social engineers contact their recipients under false motives.
- Trust: usually hijacking an already established, or trustworthy relationship.
- Emotional state: Communications include elements of pressure or urgency.
- Action: They lure their unsuspecting victim into committing a dangerous action.
Phishing
Phishing is widespread: in 2021, 83% of organizations reported experiencing phishing attacks. Most IT experts recognize the importance of accurate protection against those types of cyber security threats.
But what is phishing exactly? In phishing scams, scammers email their victim-to-be under false pretenses. They impersonate someone you know, like a supplier (which is why third-party risk management matters so much).
The email asks you to commit an action — for instance to click on a link, download attachments, or send back confidential information.
By doing this, you’ll actually be:
- Redirected to a spoofed website that’ll harvest your login credentials,
- Installing malware or spyware on your device, infecting the whole network,
- Revealing data that they’ll use to commit wire transfer fraud or resell on the dark web.
Phishing emails are quite common and, depending on the “quality” of the attack, more or less easy to detect. Phishers now also use phone calls (it’s called vishing) for the same intent. Smishing is yet another form of phishing that happens through text messages.
Whaling
Whaling is a type of spear phishing that targets an organization’s “big fish”, that is to say: a whale.
It works like phishing but is highly personalized — making it all the more dangerous. In whaling attacks, fraudsters target specific high-profile executives of a company.
For example, cybercriminals will contact a CFO pretending to be the CEO and ask for an urgent transfer to be made.
Social engineers are clever, they’ll have done some information gathering to establish:
- The key contacts in the company and their responsibilities,
- The tone of voice and wording of the people they impersonate,
- Other elements to make the communication look more realistic (a reference to a real-life event or a hobby for instance).
Thanks to social media, it’s really easy nowadays to have access to all kinds of personal information to use in different types of social engineering attacks.
Pretexting
Pretexting is one of the advanced types of social engineering attacks. Criminals create elaborate scenarios to get you to reveal sensitive information like your social security number, bank account number, or logins and passwords.
They impersonate people in positions of authority:
- A government or tax agency official,
- An external auditor,
- A representative from a financial institution or a software company.
Anyone who has some kind of power and whose actions could eventually compromise your organization — as that tends to instigate fear and lessen the questions.
In pretexting, the attacker usually asks you to confirm your identity by answering a few security questions. They can also require you to confirm some key details to “proceed with their work”.
This is a very clever way to get you to reveal confidential data. Well — it sounds obvious now, but in real life, it is not. Pretexters also tend to impersonate HR executives from your organization, and no one wants to risk crossing HR!
Baiting
Baiting is very similar to phishing. In those types of social engineering attacks, baiters lure their victim into taking a dangerous action by using our biggest vulnerability: curiosity.
Cybercriminals tempt us with the promise of something free, or exclusive:
- A free iTunes, Netflix, or Amazon gift card.
- Access to otherwise coveted information, like your company’s financial information or new HR strategy.
Baiting can happen online through targeted ads, or email attachments. It also happens IRL by planting compromised material in or near your offices’ premises.
Under false pretenses, someone could visit your bathroom and leave a hard drive labeled “Christmas bonuses”. A very enticing USB can also be left in your nearby café where your team goes for lunch, or at the cafeteria.
Curiosity kills the cat, and it may well be the cause of your company’s demise too.
Pharming
Pharming is cyber-security lingo that mixes “farming” with “phishing”. Pharmers, as they’re called, use false motives to harvest personal data.
Malicious hackers recreate a legitimate website you use (like your bank’s, or CRM’s) to steal your login credentials and reuse them for their own gain.
Spoofing websites isn’t new. In 2007, the websites of 50 financial institutions across the world were recreated to get their customers’ login info. Over 3 days, attackers collected and used this information to connect to the individuals’ accounts and send money to their own bank accounts.
Watering Hole
Slightly different from pharming are watering hole scams. Those types of social engineering attacks don’t recreate a website but rather include a backdoor or Trojan to an existing one.
The goal is the same: collect information and use it for their own malicious gain. But watering holes focus on compromising a legitimate website you visit. It means that regardless of your own cybersecurity, you can be a victim of these online threats.
Learn all there is to know about B2B fraud and how to fight it in our latest fraud report!
How can you detect and prevent social engineering attacks?
According to IBM’s 2022 cyber security report, social engineering is the leading cause of network breaches today. In order to protect your organization, you need to be ready.
Adequate protection includes:
- Prevention to reduce your risk of social engineering attacks.
- Detection, to know when they’ve happened and limit your risks of financial fraud.
Prevention measures
Security measures:
- Ensure your company uses antivirus and antimalware software, as well as antispam filters.
- Set up strong passwords requirements, and two-factor authentication to limit the risk of cyberattack.
- Don’t download unknown attachments.
- Consider using anti-fraud software to limit the risk of fraud.
Security awareness training:
- Work toward becoming a cyberaware company. Offer regular and up-to-date security training to your teams so they know the different types of social engineering attacks.
- Increase security awareness by including real-life examples of cyber attacks, and ask your IT team to run mock-up attacks to test your defenses from time to time.
Safety protocols:
- Ensure your key employees know not to disclose too much information online, which would facilitate hackers’ process
- Split up key operations (payment campaigns, procurement process, account reconciliation) into different roles. The segregation of duties lowers the risk of falling victim to fraud — including internal fraud.
How to detect social engineering attacks and protect yourself
What happens when you fall victim to a social engineering attack? Whether it’s phishing, baiting, or quid pro quo — you need to know what to do.
Here are our recommendations for your incident response plan:
- Change your passwords,
- Not authorize any external funds transfer until the breach has been identified,
- Report phishing and other attacks to law enforcement.
Most victims of social engineering attacks don’t actually know what’s happened before fraud has been committed. The faster you react, the better.
If you want to safeguard your company against the negative effects of the different types of social engineering attacks (and other types of fraud), use anti-fraud software like Trustpair.
Our solution automatically detects any fraudulent attempts and blocks suspicious transactions before they’re sent. That ensures you always know who you’re sending funds to, even in case of an online attack.
Key Takeaways:
- Social engineering attacks use psychological hacks to get their victim to compromise their security by revealing confidential information.
- Increase your overall IT security and use anti-fraud software like Trustpair to protect yourself against the effects of social engineering.
