Social Engineering

An attack that targets the person instead of the computer, using fear or hurry to get a code, a password or a payment.

Also known as human hacking people-based attack con trick

Definition

Social engineering is an attack on a person, not a computer. Nobody breaks your password. They ask for it, and they give you a good reason to hand it over. Fear, hurry and simple politeness do the rest.

Here is a real script, almost word for word. The phone rings at half past four on a Thursday. “Good afternoon, this is the fraud team at your bank. We have stopped two payments on your account. To cancel them I need the six-digit code we just sent to your phone.” The code arrives while he is speaking, because he is signing in at that very moment. The person at the desk reads it out. The money leaves before five.

The same trick wears different clothes. A WhatsApp message from an unknown number, carrying your manager's name and photo, saying he is stuck in a meeting and a supplier must be paid today. An engineer in the corridor holding a ladder, asking you to hold the door because his pass is in the van. Attacks that arrive by email have their own name, phishing, but the method underneath is the same one.

One habit stops nearly all of it. Call back. Not the number that rang you, and not a number written in the message. Use the number printed on your bank card, or the extension in your own staff list. A real employee will wait. A thief will argue, or the line will simply go quiet. Tell the whole team that hanging up is allowed and that nobody will be blamed for it.

The surprise for most owners is who gets picked. Not the finance director. The new receptionist, the driver, the student on a summer contract, people who are helpful and do not yet know who is who. When Linkysoft runs a security review, we phone the front desk before we touch a single server, and the front desk usually loses. Nobody is punished for it. The point is to find the gap while it is still cheap.

Write the payment rule on one page and hang it where the money is handled. Any change to a bank account is confirmed by voice, on a number you already had, by a second person. It costs nothing, and it is the cheapest advice Linkysoft ever gives a client.

Questions about Social Engineering

How is social engineering different from hacking?
Hacking attacks the machine. Social engineering attacks the person using it, by asking for a code or a payment with a story that sounds true. No software is broken, so most security tools never see it.
Someone called saying they are from my bank. What should I do?
Hang up and call the number printed on your bank card. A real employee will not mind waiting. Never read out a code that arrived by message, because that code is what lets them in.
Does staff training actually stop these attacks?
Training alone fades in a few months. What lasts is one written rule that everyone can follow under pressure, such as always calling back on a known number before moving money.
Who inside a company is targeted most?
New and helpful people at the edges, such as reception, drivers and interns. They are the ones who do not yet know every voice, and usually the ones nobody thought to warn.

Still not sure how this applies to your project?

Tell us what you are building and we will answer in plain language.

Start a project Contact us