Social Engineering

Social engineering is an attack on a person rather than a computer. Nobody breaks your password, because they simply ask for it and give you a good reason to hand it over. Fear, hurry and ordinary politeness do the rest.

Here is a real script, almost word for word. The phone rings at half past four on a Thursday and a calm voice says, “Good afternoon, this is the fraud team at your bank. We have stopped two payments on your account, and to cancel them I need the six-digit code we just sent you.” The code arrives while he is speaking, because he is signing in at that very moment, and the person at the desk reads it out. The money leaves before five.

The same trick wears different clothes. A WhatsApp message from an unknown number carries your manager's name and photo, and says he is stuck in a meeting while a supplier must be paid today. An engineer in the corridor holds a ladder and asks you to hold the door, because his pass is in the van. Attacks that arrive by email even have their own name, phishing, yet the method underneath is the same one.

One habit stops nearly all of it, and that habit is to call back. Use the number printed on your bank card or the extension in your staff list, never the number that rang you and never one in the message. A real employee will wait while you check, whereas a thief will argue or let the line go quiet. Tell the whole team that hanging up is allowed and nobody will be blamed for it.

The surprise for most owners is who gets picked. It is never the finance director but the new receptionist, the driver or the summer student, helpful people who do not yet know who is who. When Linkysoft runs a security review we phone the front desk before touching a single server, and the front desk usually loses. Nobody is punished for it, because the point is to find the gap while it is still cheap.

Write the payment rule on one page and hang it where the money is handled, so any change to a bank account is confirmed by voice, on a number you already had, and by a second person. It costs nothing, and it is the cheapest advice Linkysoft ever gives a client.