Industry

Social engineering attacks: What your business and users need to know

Learn how to recognize social engineering attacks on your platform and discover ways to keep your business and users safe.

An icon showing 2 people with a danger sign warning of social engineering attacks.
Last updated:
1/31/2024
Read time:
Share this post
Copied
Table of contents
⚡ Key takeaways
  • Social engineering attacks use manipulation and deception instead of exploiting technical vulnerabilities to gain unauthorized access to users’ personal information or accounts.
  • Attackers will employ various tactics to deceive their targets, including pretexting, baiting, phishing, and brandjacking.
  • A dynamic approach to identity verification and platform security can help prevent social engineering attacks. This involves switching dynamically between different modes of verification, making it harder for fraudsters to anticipate.

Imagine your grandma getting a call from a computer technician at a well-known company. They express concern about a computer virus they believe has infected her system, leaving her financial accounts vulnerable. She quickly follows the steps they outline to stay secure.

The problem is there was never a virus, and her accounts were never at risk, but they are now because she has just become a victim of a “phantom hacker” scam — the unfortunate evolution of tech support scams. 

Fraudsters often target the elderly. According to the FBI, half the victims of tech support scams are people over 60 years old and comprise 66% of the total financial losses. This unfortunately common grift is just one vicious form of social engineering.

What is social engineering?

Social engineering manipulates people into sharing confidential information or performing actions that compromise security. These attacks exploit individuals and use human interactions to gain unauthorized access instead of exploiting technical vulnerabilities. Cybercriminals using these methods often pretend to be trusted colleagues, vendors, family, or friends. In other words, it’s personal.

Social engineering is the scariest thing in fraud because it’s manipulating a good actor to do bad things. And the good actor doesn’t even know they are doing bad things.
Sahil Farooqi
Director of Business Operations at Rently

Once they capture the information they need through social engineering, bad actors have the necessary info to wreak havoc across industries, carrying out account takeovers, healthcare fraud, triangulation fraud, and more. 

Social engineering attacks generally follow this pattern:

  1. Investigation: The initial stage where fraudsters identify their targets, collect information, and determine their attack methods. This can be a large group of people or select individuals. Picture a bad actor illicitly gaining access to an online retailer’s email list to target.
  2. Hook: This is where attackers get creative, spinning a story to get the victim’s attention. The attacker engages the person, usually through written communication, and asks them to do something. Maybe the bad actor sends a mass email to the retailer’s account holders claiming there is an issue with their recent order and they need to click a link to get everything sorted. The link sends them to a malicious site that looks like the online retailer so they innocently enter their credentials.
  3. Play: Once the victim engages in the desired behavior, the attacker may choose to continue their scam to see how much damage they can do or end the play.  [Note: Many social engineering attacks are quick and happen only once. Once the bad actor has the information they need (credentials, Social Security number, bank account details, etc.) they may never engage with their targets again.]
  4. Exit: The attacker’s goal is to arouse little to no suspicion and get in and get out unnoticed. Once the bad actor has what they need, they cover their tracks and move on to the next scam.

Understanding social engineering attacks

The human nature of these attacks adds a certain layer of nuance. Before you can put systems in place to respond to and help prevent social engineering attacks, you need to understand what you’re up against. 

How attackers exploit human psychology

Bad actors have a strong understanding of human psychology, which makes it easier to trick their victims. They prey on our natural response to fear, urgency, curiosity, and authority, and use these levers to anticipate and influence human behavior. It’s harder to rely solely on technology to crack a business’s security perimeter than it is to get people to share their credentials willingly.

Types of social engineering attacks

Social engineering has a long history, and these attacks have come a long way from the Nigerian prince days. Attackers will employ various tactics to deceive their targets, including pretexting, baiting, phishing, and brandjacking.

Pretexting

This is where the lie is baked into the attack. Pretexting is the use of a fake story (or pretext) to gain a victim’s trust and trick them into sharing sensitive information or sending money to criminals. 

The attacker will attempt to build trust with the victim by impersonating bosses, coworkers, IT professionals, family members, police, bank and tax officials, or people in other positions of authority. It can be as simple as a message that says, “Hey Grandpa, I’m stuck in Omaha and using a buddy’s phone. Can you send $500 to this Venmo account?”

Real-world example: In what may be a glimpse into the future of pretexting, in 2019, scammers tricked a UK energy firm out of $243,000 by using artificial intelligence (AI) to impersonate the voice of the CEO of the firm's parent company and make fraudulent phone calls requesting payments to the firm's suppliers.

Baiting

As the name suggests, baiting attacks involve a false promise to lure the victim into a trap, usually piquing curiosity or offering a deal that’s too good to pass up. With how much time we all spend online, it’s easy to see how even the most vigilant among us can skim over a text or email and fall into a trap through a single errant click on a bad link.

Real-world example: A bad actor contacts a seller on an online marketplace who bids on movie memorabilia. They send them a message with an offer that is too good to be true — they have an item very similar to the one they bid on at half the price. They just need to continue the conversation off-platform to set up a deal. The bad actor then convinces the seller to send them money with nothing in return.

Phishing

Phishing scams are considered the most popular type of social engineering attack. In fact, a shocking 90% of all cyberattacks begin with phishing. They involve email and text message campaigns created to drive a sense of urgency, curiosity, or fear. The message usually appears to be sent from a trusted contact and tells a compelling story, convincing the victim to do something out of the ordinary like click a link or download an attachment.

Spear phishing is a more targeted version of phishing, where an attacker goes after specific individuals who have unique access to critical systems or significant influence within a company. While these attacks take longer to pull off, they can be incredibly effective.

Real-world example: As reported by The New York Times, a woman met who she believed to be a handsome architect on the dating app Hinge. After texting for months, the man offered to help her make money by trading Bitcoin and other cryptocurrencies. Within weeks, the woman had sent more than $300,000 worth of Bitcoin — nearly her entire life savings — to a false account. Then she learned it was all a lie and the man vanished.

Brandjacking

Brandjacking is the act of using a well-known brand’s name, logo, identity, or intellectual property to mislead people. It can come in the form of phishing emails, fake websites, and fake social media accounts. These attacks can have very real consequences for the actual brands scammers are impersonating.

Real-world example: Remember that story about grandma? The fraudster executed their “phantom scam” by pretending to be an employee of a well-known technology company she knew. Preying on a victim’s existing trust and relationship with a leading brand is a common form of social engineering.  

The impact of social engineering on businesses

Social engineering attacks can be extremely lucrative for cybercriminals. The motive is usually financial gain, which can cost you or your customers a lot of money. Beyond this calculable loss is the damage done to your company’s reputation, which can have significant, long-term repercussions for your business. 

Financial losses

Losses due to social engineering attacks can quickly add up to millions of dollars. Remediation costs include stolen money, lost productivity, theft of intellectual property, theft of personal and financial data, embezzlement, and fraud. According to the FBI, about 19,000 victims of tech-support scams submitted complaints between January 2023 and June 2023. Estimated losses totaled more than $542 million. As of August 2023, losses have already exceeded those in 2022 by 40%.

Reputational damage

Falling victim to social engineering can tarnish a company's reputation and erode trust. Trust is hard to regain once it’s lost, and customers or business partners may be hesitant to do business with a company that has been compromised or doesn’t make security a top priority. In fact, according to Malwarebytes Labs, 75% of those surveyed said they’d stop doing business with a company that has fallen victim to a breach or cyberattack that potentially compromised data.

Recognizing individual social engineering attacks

Becoming the victim of a social engineering attack is not inevitable. There are certain signs you can look out for to help you recognize social engineering attempts everywhere you connect in today’s digital world: your inbox, voicemail, direct messages (DMs), text messages, marketplace accounts, and more.

Common signs of social engineering attempts

  • You receive an urgent message requesting immediate assistance
  • The message contains a suspicious file attachment or URL
  • The message has multiple grammatical errors or typos
  • The sender’s email is misspelled or doesn’t match the organization
  • You are asked to verify your information
  • A message arrives unexpectedly with a specific request
  • The message asks you to perform an action that is out of the ordinary
  • The offer appears too good to be true
  • The message feels overly eager or threatening

Spotting social engineering attempts on your platform

Bad actors want to take advantage of the community you’ve worked hard to build. Whether your business is a social media platform, marketplace, online dating site, cryptocurrency exchange, or other platform, the more you know about your users and can tune your fraud tools to spot anomalies, the easier it will be to automatically flag suspicious behavior for further investigation.

There are common risky behaviors, anomalies, and repeated suspicious activities you should look out for. It’s also important to scan your internal data to spot new patterns and continually tune your fraud tech stack. 

Signs of potential social engineering in your community

  • Multiple users logging in from the same devices and IPs
  • Multiple accounts created using the same onboarding information (names, addresses) 
  • Change in IP and device post-account creation
  • Consistent or identical user behavior from seemingly disconnected accounts

Prevention strategies for businesses

Even though social engineering attacks are becoming more sophisticated by the day, there are a few approaches you can take to be proactive about fraud and help prevent these types of crimes. Just remember, your fraud tooling isn’t a “set it and forget it” program you review once a year. It also shouldn’t be hyper-focused on addressing one type of fraud or tactic, but rather offer a multilayered approach to prevention that addresses many types of fraud and methods of attack.

The only way to be on top of social engineering is to always be aware of the current trends that are happening in your space when it comes to fraud, and using those trends to alter and update your content.
Sahil Farooqi
Director of Business Operations at Rently

Encourage users to implement strong authentication measures

One password isn’t enough to secure an account. Requiring users to implement two-factor (2FA) or multi-factor authentication (MFA) and educating them on its importance significantly reduces the risk of unauthorized access. These additional layers of authentication can come in the form of security questions, captcha, fingerprinting, face scanning, SMS confirmation codes, and more.

Add progressive risk segmentation 

Your user onboarding process is the first hurdle a fraudster must cross to gain access to your platform and community. This is where you can block potential fraudsters and lower your risk.

Progressive risk segmentation is a strategy that helps you balance fraud prevention with user experience by automatically segmenting individuals based on real-time signals and adjusting the level of identity verification based on the riskiness of the interaction. 

Traditional verification methods ask users to complete the same steps no matter how risky the transaction. Progressive risk segmentation lets you step up and down friction to modify a user’s experience based on signals it picks up during the verification process. 

With Persona’s Verifications and Dynamic Flow products, you can quickly set up custom flows to verify good users and block bad actors — no code needed. Users who readily pass your initial verification checks can move quickly through your flow while others exhibiting passive risk signals — hesitation time, shortcut usage, and more — can be automatically routed to a different path where they may be asked to take a selfie or check their email or phone for a confirmation code, for example. Criminals possessing hundreds of fake IDs and stolen information will likely not remember the phone number or email address they entered for a fake account they created, giving you a better chance of deterring would-be fraudsters.

Customer education and open communication

Fraudsters continue to innovate, so awareness and education are key. Sometimes your best defense against fraudsters are the good actors and legitimate users on your platform. Keep the lines of communication open and offer helpful educational resources they can easily access and put to good use: 

  • Provide help center articles and customer support to address these types of attacks
  • Provide customer avenues to contact you directly to provide feedback and report social engineering attacks
  • Add prompts to your user flow that stop victims and ask them to think about the information they are about to divulge. Some good examples of this are the pop-ups commonly seen on payment apps when you send money to a user you’ve never paid before.

Document an incident response plan

Prevention is the goal, but you also need to develop an incident response (IR) plan to minimize damage in case of a suspected social engineering attack. This detailed plan should outline how your organization prepares, detects, and responds to fraud on your platform.

If you suspect fraud in your community, you should:

  • Collect examples of confirmed or presumed social engineering for investigation
  • Expand your investigation outward for more intelligence leveraging link analysis, a method of analyzing data that allows you to study relationships that aren’t visible in raw data, like known patterns, new patterns, and anomalies
  • Acknowledge that a lot of fraud resulting from social engineering happens outside of systems you can monitor (email, messaging apps, etc.), so you may need to ask victims for correspondence and instruction from fraudsters to help with the investigation
  • Update policies, procedures, and technology based on the findings

Employee awareness training

The types of social engineering affecting your users are the same ones hitting the inboxes of your employees sent by bad actors trying to infiltrate your company. This is why employee awareness training is critical.

Educate your team about the dangers of social engineering, how to recognize potential threats, and the best ways to report incidents to security. Some employee security training offers phishing simulations and exercises to help your teams engage and interact with cybersecurity scenarios and best practices.

How Persona can help mitigate the effects of social engineering

No technology can put a stop to social engineering. The best you can do is ensure your team is vigilant and has a process in place for identifying activity typical of social engineering and working with an identity verification and fraud prevention partner to mitigate its downstream effects. 

Persona is a unified identity platform, helping companies from multiple industries, including fintech, digital health, e-learning, and marketplaces combat social engineering attacks and sophisticated fraud. 

We are privileged to partner with Rently, a company that lets potential buyers or renters schedule self-tours to view properties, for its verification and fraud prevention needs. It uses Persona to verify that the same individual who signed up online is the person who shows up to view the property. This helps prevent fraudsters from impersonating legitimate property managers to take listings off-platform or gain access to properties under false pretenses. 

With Persona, Rently built workflows to support ID types for all geographies and automated decisioning so only the approved IDs are passed through the system. Dynamic Flow makes it possible to introduce and adjust friction based on the user’s risk profile, which doesn’t have much of an impact on good users but makes things a lot harder on bad actors. And Persona’s reverification functionality makes it easy for renters to safely tour multiple properties. 

Having the ability to change the content on the KYC gives us that edge to stay ahead of the scammers. If we're able to pick up that trend and actually change the content, we're actually producing awareness in a controlled environment where the user is going to be fully attentive and we'll be responding positively to that awareness.
Sahil Farooqi
Director of Business Operations at Rently
Case study
See how Rently protects renters and its business with Persona

You’re one step closer to creating a dynamic, multilayered approach to identity verification and security to fight social engineering. Want to learn more? Sign up for Persona for free or request a demo to see our platform in action. 

Published on:
11/20/2023

Frequently asked questions

How do social engineering attacks differ from other cybersecurity threats?

Social engineering is a form of cyberattack that relies on manipulating human psychology rather than exploiting technical vulnerabilities. These attacks involve the psychological compromise of a person that alters their behavior into taking an action or breaching confidentiality. The hallmark of social engineering attacks is manipulation and deception.

Why are employees often the primary target of social engineering attacks?

It’s much harder to breach a company’s technical security alone than it is to find an  unsuspecting employee at a large company. This is why social engineers have developed a strong understanding of human psychology, making it easier to trick their victims. They prey on our natural response to fear, urgency, curiosity, and authority, and use these levers to anticipate and influence human behavior. Bad actors often pretend to be executives, managers, and colleagues to trick the targeted individual. 

What are some effective authentication measures that businesses can implement to enhance security and mitigate the effects of social engineering?

While there is no silver bullet to combat social engineering or any other type of fraud for that matter, we suggest implementing a dynamic approach that switches verification methods based on risk signals and data. This makes it much harder for fraudsters to anticipate and execute their scams. For example, a company can tailor its process to ask for credentials, but if passive signals raise suspicion, a code may be required and sent over text. 

Continue reading

Continue reading

Minimizing referral fraud while growing your online marketplace
Minimizing referral fraud while growing your online marketplace
Industry

Minimizing referral fraud while growing your online marketplace

Learn about common referral fraud schemes and how they can impact your marketplace. Discover strategies for protecting your buyers, sellers, and business.

From fraud to fairness: Leveraging KYC and age verification for online gaming
From fraud to fairness: Leveraging KYC and age verification for online gaming
Industry

From fraud to fairness: Leveraging KYC and age verification for online gaming

KYC can help keep online gamers of all ages safe and reduce fraud. Learn how KYC and age verification can benefit your gaming platform.

How to fight ID fraud in a world of generative AI
How to fight ID fraud in a world of generative AI
Industry

How to fight ID fraud in a world of generative AI

Learn how generative AI is changing the game when it comes to fake IDs and what you should be mindful of when enhancing your fraud strategy.

AI phishing attacks: What you need to know to protect your users
Industry

AI phishing attacks: What you need to know to protect your users

Phishing has become more sophisticated thanks to AI. Learn more.

Fraud detection: 5 methods to protect your customers and business
Industry

Fraud detection: 5 methods to protect your customers and business

Fraudsters will occasionally slip through even the best-laid defenses. Learn 5 fraud detection methods you may want to consider for your business.

Fight fraud at every angle with Persona
Announcement

Fight fraud at every angle with Persona

Introducing new capabilities to help fight complex fraud.

Ready to get started?

Get in touch or start exploring Persona today.