With all the different ways we communicate, it can be difficult to discern real messages from fake ones. Even with training, social engineering remains a threat to your business' cybersecurity.
This is when cybercriminals take advantage of human psychology to manipulate unsuspecting victims to give up compromising information, money, and more.
Social engineering is not always complicated. Know the signs and avenues they use, so you can mitigate the risk of becoming a victim of a data breach. Here are a few tricks cybercriminals use to gain a foothold in your network, and proactive measures to combat it.
Email Spoofing
Perhaps the most commonly seen forms of social engineering is email spoofing, or phishing. While most people have spam folders that catch obvious scam emails, some can slip through by looking legitimate enough. This is where cybercriminals have gotten extremely good at making nuanced tweaks seem genuine. A few types of phishing include:
Spear phishing- cybercriminals find specific information about one target person, tailoring emails with their family members’ names and other personal details to seem legitimate.
Angler phishing – Emails posing as social media customer support saying that your account has been compromised.
Smishing- Text messages that spoof a person or organization trying to get you to do something.
AI Has Changed the Game of Social Engineering
Gone are the days when grammatical errors were the best way to determine whether an email or text was legitimate. Artificial intelligence has allowed hackers to seem professional and polished in emails. Generative AI can create generic and grammatically sound emails, messages, and other communications that look just like what a real colleague or family member would write.
Scam Phone Calls
Although most people know what to listen for in scam phone calls, some can still seem real. Vishing, or phone call spoofing, has led to tremendous financial loss and compromised personal information for unsuspecting victims. Cybercriminals often invent dramatic and emotionally charged scenarios to elicit the most reactive response possible from victims.
You might think you’re immune to being tricked, but AI technology has evolved to allow scammers to replicate any human voice with only a few lines of real recordings. This means criminals can make a voice that sounds exactly like your child, spouse or boss on the other line making a legitimate call.
How to Combat AI Vishing
Some of these AI kidnapping scams or similar scenarios are rampantly used to fool victims. Some common signs of vishing scams include:
- The caller telling you not to call them back on the phone number they’re calling from
- Emotionally intense situations like car crashes, arrests, getting mugged, etc.
- Urgency to act, send money, purchase gift cards, or give away personal information.
Although there is no foolproof AI scam protection, there are a few things to help you sniff out a scam. If you receive a phone call about your child or loved one getting arrested or another intense situation, have a secret phrase or code that only the two of you know. This should be hard to guess or find online, and it can help you discern if it’s really an emergency or a scam.
It’s also wise to reach out to another family member or contact the person in question via another means. If it’s a true emergency, they’ll be able to verify by having you call them back at the same number to ensure it’s not a generated fake number.
Fake Services/Vendors
Cybercriminals will sometimes pose as a customer, service or vendor trying to get help via your business’ customer service line. Scammers deceived MGM's customer service by posing as a vendor. This allowed them to gain unauthorized access to a hotel and casino system in Las Vegas.
Pharming/Website Spoofing
As easy as it is to create a website these days, it’s just as easy to create a fake website to mimic an existing one. Pharming is when cybercriminals create fake websites that appear to be real businesses or institutions. These sites will inject malware into the computers of whoever enters the site.
The best way to reduce your risk of falling victim to pharming websites is to avoid clicking on any links in emails, unless you absolutely trust the sender.
Pharming Login Pages to Fool Your Staff
Hackers might make a fake version of your business' website to trick employees into entering their login details. Adding a company logo to your existing page is a great way to keep your employees from plugging personal details into a fake version of your site’s login page.
This is because if they're used to seeing the logo when signing in, its absence might make it easier for them to spot a fake page.
Rubber Duckies
Rubber Duckies are a tricky way for criminals to infect your business network. It’s as simple as injecting malware into a USB drive, labeling with a phrase like “Employee Salary Report” and leaving it in a parking lot. This form of social engineering tempts people to plug physical hardware directly into their computers.
To mitigate the risk of USB rubber duckies, train your staff to avoid plugging in unknown USB drives or other devices into their computers. With all of the technology for file sharing and data backup, USB drives can become more of a risk than they’re worth for your cybersecurity.
How to Defend Against Social Engineering
As you’re creating your cybersecurity strategy, you should assess your organization’s risk level for cyber attacks. Evaluate the tools you have or need for training on phishing awareness, data security, strong passwords, MFA, encryption, and data backup. It’s also wise to partner with a managed IT provider to help you decide on the right mix of tools.
To learn more about proactive cybersecurity measures you can take to secure your business, click the button below to get our exclusive cybersecurity checklist pdf.
