Social Engineering: How criminals manipulate you

Welcome to what is probably THE most used technique of the cyber criminal & fraudster, and what is undoubtedly THE most crucial piece of information for you on this site. 

So QUICK……READ THIS ARTICLE BEFORE IT DISAPPEARS FOREVER

Just kidding……..that’s just a bit of social engineering for you!

What is Social Engineering?

Quite simply, it’s someone tricking you into doing something you wouldn’t normally do by using psychological manipulation.

This technique is used in almost all types of cyber attacks against a person, such as Phishing, and all types of frauds and scams.

Why is it used so often?

As an attacker, it is much easier for me to make a person do something they wouldn’t do, than it is to make a piece a technology do something it wouldn’t normally do. 

How does it work?

Criminals know that we are all just humans, and as such, we all have some things in common.  In this case, it’s making fast, or bad decisions when you are emotional.  I’m sure that you can think of a time where you were emotional and regret acting in a certain way.  Well, that’s what their aim is…….make you emotional and act irrationally. 

What emotions do they try to make you feel?

By far, the most common emotions to look out for are:

1. Fear: They will try to make you believe that if you don’t do what they say, something bad will happen.  😱
   

2. Panic:  They will insist that unless you act urgently then you will lose that amazing opportunity, or something bad will happen.  The last thing they want you to do is stop and think rationally.  😬
   

3. Excitement: They will give you an offer that is simply too good to be true, in the hope that you just can’t turn it down.  🤗
   

4. Curiosity: Cat’s aren’t the only ones that should be wary of curiosity.  They will give you only small bits of information and invite you to click on links in emails to find out more. 🤔
   

5. Compassion:  They will try to leverage your natural desire to be a good person by trying to make you feel bad for their situation. 🥰
   

6. Anxiety:  We all panic when there’s a police car behind us…even if we’ve done nothing wrong!  So they try to exploit our instincts by impersonating authority figures such as the police, courts, or even famous people. 😟
   

7. Trust:  They will try to manipulate you by impersonating organisations or people that you trust, or even worse, build some sort of trusting relationship directly with you, so they can abuse that trust later.   🤝

Here are some genuine, real life examples of Social Engineering in practice:

Examples:

Fear & Urgency: Imagine receiving an email  where they tell you that they have some pictures or video of you naked, and if you don’t send them money they will send them to everyone you know.  Sometimes they will even ‘prove’ that they are in your online accounts by telling you your password!......well, believe it or not, they don’t have those pictures and they are not in your accounts.  Find out how they do it and how to respond in our Sextortion article (Link to article)

Excitement:  Imagine finding a bargain on an online shopping site like Ebay.  You can’t believe your luck, this is an offer just too good to be true, and all you have to do is to leave the safety of the site you are on and make a direct payment into a bank account.  Unfortunately for you, you will never see that bargain….or that money again.  See our online shopping scams article on our Fraud & Financial Security page to learn more about these types of scams. (Link to article)

Respect for Authority & Urgency:  You receive a phone call in the middle of the night and it’s the Police, or Hospital telling you that your child, or grandchild is in trouble, or in danger and the only way to get them out of danger is to pay the fine, or pay for the surgery that’s urgently needed.  Find out more about this type of attack on our Vishing article (Link)

 How can you stop it?

You can’t!  Social Engineering can be used against you even if the attacker knows nothing about you. However, sometimes you unknowingly give them all the information they need to make their attacks so incredibly convincing, so much so that even an expert might be deceived.  Consider those last three examples, but imagine if the attacker also used personal details like your date of birth, address, or the school you went to…..or anything else which they shouldn’t know.

But don’t panic!  In the world of online security….knowledge is power.  Now that you understand these techniques, you are much better prepared to identify when someone is trying to socially engineer you.  So try to remember:

Whenever you feel a strong emotion being triggered……….Stop……….Take a breath…….And try to think rationally.  This pause can be your greatest defence against becoming a victim of social engineering.

Want to stop the attackers getting specific information about you?  Then visit our Social Media Security page, and see how you can stop criminals using them to make super convincing social engineering attacks.

Are you new to this world and want to go through our step by step beginners guide to make sure you have all the basics right?  Visit our Beginners Guide.

Or continue with our introduction and go to the next article and learn about the different types of attackers that exist, and the ones likely to target you at home.

But before you go…….Test yourself on Social Engineering:  Watch this 2 minute video of a social engineering attack and identify which emotional triggers are being used.

Scroll Down to Reveal the answer!

Compassion: ‘Please, the baby is crying’

Panic/urgency: ‘I have to get this done today’