Introduction

It could be a thing of surprise to one finding out that some internet fraudsters aren’t technical, computer literate or cyber aware, but still successfully launch a cyber-attack. The gap between a cyber-attack victim or the target and preventing being scammed, is information. That is, with the appropriate information, one can be a step ahead of the scammer, thereby securing oneself and gadgets. The target of every attacker is to cause disruption and destruction to a victim’s network, steal money and data to run a bigger attack by impersonating. So with appropriate information like what we will provide in this article, one can protect himself from being socially engineered.

What is social engineering?

Social engineering is the psychological manipulation of someone to reveal confidential information that can be used to carry out malicious activities. This act doesn’t necessary need the cyber attacker to be a computer literate, but he (the cyber attacker) can hijack your amygdala and feast on your emotions or desires, then he is more successful than a computer guru who technically infiltrates a computer network. In this case, we will say that the target has been socially engineered by the attacker.

Social engineering methods

There are so many social engineering methods but for the purpose of this article, we will be treating the four most common methods;

Phising: this is the type of social engineering attackers often used to steal the user’s data, including login credentials and credit card numbers. It’s popularly done through sending emails with attachment files (that contains malware) or typosquatting (or URL hijacking) a legit link that redirects the target to a malicious site. The mail is received using an internet connection, but those aren’t connected to the internet aren’t left out in being scammed.

Vishing: is the type of social engineering that has to do with voice calls. Here the attacker calls you on phone, impersonates a position or person, builds a reasonable amount of trust, stir emotions, then requests you to disclose your personal information, company’s confidentiality or send money. A good example is a fraudster pretending to be a said bank customer care personnel, demanding your bank details for some reasons. Sometimes, fraudsters would need some spoofing technologies (like software, voice changer, etc), background sound app (giving background sounds like call centre, carrying baby, etc) to enhance their act or better convince the victim; but the unavailability of that might force them into trying other means them into trying other means. In a case where the fraudster only have the victim’s phone number and calling isn’t the best option to try, then an attack can still be carried out through other means.

Smishing: is a social engineering attack carried out over mobile text message, it is also known as sms phising. Just like a message sent to a victim’s email, the same message with malicious instructions and link could also be sent through text message. An example is a target receiving a text message that he has won a grant and asked to click on a malicious mail to claim it. Funny as it may be, the target might not have applied for the said grant but wants to claim what isn’t his.

In the above three methods explained above, we realised that the fraudsters has at least the target’s phone number or email address. Sometimes these information aren’t easy to fetch, though dumpster diving can be initialised (see our next post on cyber exploitation) but the fraudster might wish “to take the bull by the horn” . Haven discussed the common methods of social engineering, there’s still need to discuss the tricks involved so as to be proactive/ aware.

Social engineering tricks

1. Gaining trust: just as trust is an essential tool in business, here also the fraudster builds familiarity and trust with the target. Maybe by impersonating someone or sharing information you might have made public on social media or conversed with someone.
2. Helpfulness: the fraudster creates fake problem and presents himself as a solution to that problem. Example, calling the target on a weekend to inform him of his bank’s data breach, how his data was among those lost and offers to help him rectify the issue. Then the fraudster goes ahead to request for his bank details.
3. Steer emotions: Emotions like fear, pride, pleasure, are being triggered and the victim manoeuvred, compelling the target to act impulsively. Sometime in April 2022 someone called me, dissembled to be a native doctor from Enugu-ezike in Enugu state Nigeria, he divulged to me that a group of boys came to him and asked him to kill me. So he called to tell me to pay some certain amount of money to avert it. Scary isn’t it? That’s exactly what we mean by steering emotions like fear.
4. Offering rewards: the fraudster offers some sort of rewards like, money, bitcon, gifts, etc, just to get target’s attention and execute an exploit.
5. Urgency: is a key trick to a fraudster, preventing the target from having enough time for rational thoughts about the situation.
6. Ask the target to break protocol.
7. Blackmail

Effects of social engineering

1. Financial losses
2. Disruption of service
3. Destruction of service & business
4. Reputational damage

Ways of preventing social engineering

1. Verify the authenticity of any information received before acting.
2. Cultivate a good privacy culture, both physically and on social media.
3. Build a zero trust mind-set.
4. Trust your gut.
5. Download apps only from your app store, play store or Microsoft store.
6. Verify sender’s details like, name, email address, contact address, phone number, etc.
7. Look out for red flag in any information received.
8. Report any red flag.
9. Turn on two-step verification and have a strong password. (detailed in our future post)
10. Engage in an on-going cyber security awareness program.
11. Be conscious of your environs.
12. Kill greed.

Conclusion

It is satisfactory that an article of this sort, thoroughly summarized some methods of social engineering, not leaving out the explanation of what social engineering is. Awareness like this is paramount to our societal cyber safety, as digitalization is no longer news to the public. However, social engineering tricks exposes us to the world of a cyber-attacker and enlighten us on how our physical vulnerability and be exploited and weaponized. The effects of social engineering further motivates us on the need to be security aware, thereafter backed up with the ways of preventing social engineering attacks. What matters is not publishing a comprehensive article but that we are aware of the cyber threats out there, take precautions and help deliver a cyber-safe world.