What is a Social Engineering Attack? Techniques and Ways to Prevent

Everyone has received a spam text or email at some point. Their hallmarks are widely known; they often include poor or strange grammar, suspicious links, suggested connections with companies or people, or random individuals asking for help in some capacity. Sometimes, these communications allow scammers and malicious actors to learn about their targets. These targets may be individuals, companies, vendors, software hosts, or any other entity with data worth a cent. These communications transform from opportunistic schemes to sophisticated social engineering attacks when this happens.

What are Social Engineering Attacks?

In cybersecurity, social engineering attacks are also called “phishing”. Phishing attacks are social engineering attacks, but not all social engineering events are phishing attempts. For the malicious agent, a social engineering attack aims to learn or obtain information about their target (or collect money through gift cards or cash).

By definition, “social engineering attack” means manipulation; whereas a decade ago, these attacks might have been composed of a single random text with a clickable link, and now, they have elements that manipulate victims into complying with the requests of a malicious actor. These are often emotionally charged communications—playing on the hope that people are either (1) willing to help another in need or (2) in enough desperation that they cannot “pass” on the offer presented to them.

Where social engineering attacks happen is within the context of business or value; malicious actors target the employees of organizations to garner information for data breaches or other illegal propagations, and those malicious actors that target individuals are after their victim’s valuables (i.e., money, accounts, sensitive data). All of this comes together to mean one thing for the public: social engineering attacks are highly effective—and dangerous.

Why Social Engineering Attacks Are Effective

Emotional appeals best identify social engineering attacks. These manipulative attacks encourage victims to empathize with or fear the sender—depending on the end motives of the criminal. The warning signs of a budding social engineering attack are glaringly apparent once users learn what to look for; some of the most common hooking attempts include:

• Requests for immediate assistance, where the criminal pushes a time-limited narrative, and some criminals can forge counterfeit documents to aid their story.
• Requests for verifying information, where a criminal poses as a network or professional authority—usually to trick an employee into giving up passwords - underscore the critical importance of password security.
• Communications that seem nervous or distant upon being questioned for details; most social engineering crimes use limited details and emotional pressure.
• When all else fails, the criminals could threaten reprimands if they don’t get what they want. Never interact with these messages—block them immediately.

Of course, there will always be those social engineering attacks that do not utilize these emotional signs. In situations like this, potential victims should rely on what they know about the person they speak with. Here are some ways to detect social engineering attacks without the indicator of emotional appeal:

• If the communication lists an altered hyperlink or website, never interact with links sent by strangers—ensure the link is safe and owned by the right platform.
• If the message contains attachments, avoid clicking on them. Delete the communication, report it as soon as possible, and never look at the attachment.
• Lastly, note the communication’s spelling and layout. One of the most common indicators of scammers is their hackneyed spelling; meanwhile, a poorly curated layout can indicate limited development knowledge—either way, these options point to criminals. 

Social Engineering Attack Examples and Scenarios

There is a wide variety of ways in which social engineering can create victims. Some victims find themselves the target of social engineering attacks from friends, cohorts, or family members. No matter how the communication is delivered, the end goal is manipulation, pushing victims into surrendering information. The most common of these attack vectors include:

Phishing and Spear Phishing

Phishing may be the most recognizable attack method for these criminals. They send their potential victims emails or text messages, typically asking for them to confirm specific data elements related to them; for example, someone could receive a text from “HR” requesting that the user “confirm” their password. If the user hands it over without verifying who the email came from—they could open the door for a malicious account takeover.

Phishing happens on a big scale. Spear phishing narrows that scope to a few individuals; these attacks are particularly effective because they convince the target to cooperate, banking on a mix of authority and assumption. Individuals can combat these threats by ensuring they know the sender and receiver of their communications. 

Vishing and Smishing

When phishing occurs over SMS, it becomes smishing, where potential victims are sent “updates” on their packages, pleads to call “Aunt Jenna,” and various one-off bait messages. In nearly all instances of smishing, victims receive a short message—typically pressuring the victim into clicking a link or completing some other data-exposing task. Even the photos and attachments sent with these messages may harbor infective potential.

Alternatively, when phishing occurs over voice, the attack becomes vishing, a malicious actor calling their target directly and asking for information. These threat actors can easily impersonate authoritative individuals, from HR representatives to IT guys a few states over. If criminals obtain identity authorization information before calling, like an employee ID number, there is no way for anyone to stop the scheme before it is complete.

Ultimately, these attacks come down to response. Everyone, without exception, should immediately delete short, strange text messages with gross-looking links; additionally, a verification callback is necessary for every inbound call—don’t use the number they call from or give; call the company or line extension directly.

Contact Spamming and Baiting

The signs of contact spamming are nuanced and depend on how well two people know each other. The attack begins with a hacker accessing a user’s account; from within the account, they can send messages to other users in the profile’s friend list. The messages can range from “needing funds” to malicious links and attachments. Users who notice suspicious activity from a friend’s account should check in with them before reporting the behavior.

Baiting is another alternative for these cybercriminals; they “bait” a victim into doing something for them—to various impacts. Some baiting attacks begin by preying on a person’s interest. Criminals might leave infected USBs or phone chargers in public areas, or they could create scenarios to encourage the usage of a physical device they provide. Those who have accepted devices from strangers must stop using them immediately.

Scareware and Pretexting

Both scareware and pretexting manipulate victims by impersonating danger. Scareware is the more aggressive of the two—it often takes the form of flashing pop-ups, feigning knowledge about the “viruses/spyware/malware” programs on the device. When clicked, the pop-up takes the user to another page, immediately setting them up for attack. The best way to deal with these pages is to leave the website immediately and report it where possible.

Pretesting’s impersonations are far quieter and consequently more dangerous. Pretexting requires criminals to know significant details about their victims, such as the names of their providers or internal organization structure. These criminals mostly abuse right-to-know jurisdictions, including the police, medical officials, bank or tax officials, coworkers, or HR representatives. Anyone can mitigate these attacks by verifying who you are speaking with through multiple authorizations, including calling back inbound calls.

Quid Pro Quo and Farming

Some social engineering attacks have scammers provide “services” to someone for a fee or free. In either case, the idea is that the criminal has a service the victim needs; the criminal either delays the completion of the data (i.e., “we need a special part,” “we need to wait for someone else,” or “we can’t do that today”) or they “fix” or “resolve” the issue. The assailants project authority through experience; the voice element is essential in these plots. Consequently, getting off the phone as quickly as possible is vital.

Lastly, there’s the long-con: farming. Where other methods are brutal, this method is insidious. It requires the criminal to have a decent relationship with their victim—although the closer they get, the more challenging this becomes. When these attacks succeed, they are potentially more destructive than the other options, with varying impacts. Victims of these schemes must notify officials of the potential security breach.

Social Engineering Attacks and Countermeasures

Although social engineering attacks are efficient for criminals and destructive for victims, they are also easily mitigated. Social engineering attacks and security measures for them boil down to straightforward rules about stranger danger. Moreover, social engineering attack prevention comes down to the potential victim, whether they verify who they are speaking with, take a step back from the situation and review the facts, or ensure their accounts and permissions are correctly secured.

Check the Source and What They Know

The first and most important rule regarding social engineering is to not speak with strangers; however, in a fully connected world, this may be more challenging than it first seems. Are you waiting for a callback from the car shop or a job interview? If a malicious actor calls during this time, they could trick you into sharing details with impersonation. In the case of calling and texting, potential victims can hang up or delete the message before reaching out directly to the correct party.

Ask for Identification

No one should be handing out copies of their driver’s license; however, having some form of identification can distinguish between a successful social engineering event and a failure. Employee IDs, verbal passwords, and secondary authorizations are all excellent countermeasures for these attacks. Further, these countermeasures may fail if the criminal already knows the information. For this reason, individuals and employees must keep their credentials—like trade secrets—secret.

Is this Realistic?

Did you receive a message congratulating you on winning the lottery? Suddenly in the running for a free, new phone? These are topics that social engineering scammers use. They can target groups of people, as in the case of mass texts, or they can target individuals—particularly those that offer a lot of free information about themselves online. Before responding to any of these opportunities, take a moment to reflect on the details. The offer may be too good to be true.

Stop and Think

Some social engineering attacks utilize pressurized time to push the victim into compliance. They might have a tiny window to “save” their friend from jail, or the victim can “obtain” a limited-time offer. Although many victims fall for these scams, they can often recognize the plot if they step back. Also called “breaking the loop,” getting away from the scammers to think critically about their story (and what they want, i.e., cash, gift cards, access codes, and other data) is often enough to reveal the scam.

Secure Your Devices and Accounts

Social engineering isn’t only online or via communications—it can also happen in person and to others. Shoulder surfing, for example, is an efficient way for scammers to enjoy a day out while peering over the shoulders of their victims; this is a surefire way to obtain the passcode to more than just the victim’s cellphone. At the same time, if a friend’s account is compromised, there may be no way for other targets to know something is wrong (unless they know the victim very well). However, anyone can largely mitigate these problems with additional authentication processes on all devices and accounts.

Anytime someone attempts to obtain money or information from another through manipulation or coercion, it is a social engineering scheme. These attacks can be immediate or long-term; they can happen over communications or in person; the criminals can offer a fraudulent “service” in the hopes that they can convince the victim to return at a later date, they can promise sure-fire investments, or they can target the network data of organizations. In short, these socially manipulative scams can happen to anyone, at any time, for any reason; consequently, everyone must learn how to identify and defend against these efficient and destructive schemes.