5 Types of Social Engineering Scams to Know

so·cial en·gi·neer·ing

sōSHəl ˌenjəˈni(ə)riNG

(in the context of information security) the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes. ‘anyone with online accounts should watch for phishing attacks and other forms of social engineering’

Phishing

The leading tactic leveraged by today’s ransomware hackers, typically delivered in the form of an email, chat, web ad or website designed to impersonate a real system or organization. Often crafted to deliver a sense of urgency and importance, the message within these emails often appears to be from widely used products or companies and can include logos, branding and verbiage copied from the source to appear authentic.

Baiting

Similar to phishing, baiting involves offering something enticing to an end user in exchange for private data. The “bait” comes in many forms, both digital and physical. Such as the live stream of a popular event, or as a branded flash drive with an enticing label like “Executive Salary Summary Q3 2016” that is left out on a desk for an end user to find. Once the bait is taken, malicious software is delivered directly into the victim’s computer.

Quid Pro Quo

Similar to baiting, quid pro quo involves a request for the exchange of private data but for a service. For example, an employee might see an ad for free IT assistance which eventually requests the exchange of login credentials.

Spear Phishing

When a hacker crafts communication specific to a small set of users, such as the accounting department of a target organization. The hacker creates a false sense of trust between themselves and the end user by impersonating a co-worker or a figure of authority within the company, often using the same communication style as the person they are impersonating. For example, a hacker may send a request for employee W2’s from the CEO during an audit or another time when the HR department would expect this type of request.

Tailgating

When an unauthorized person physically follows an employee into a restricted corporate area or system. The most common example of this is when a hacker calls out to an employee to hold a door open for them as they’ve forgotten their RFID card. Another example of tailgating is when a hacker asks an employee to “borrow” a private laptop for a few minutes, during which the criminal is quickly able to steal data or install malicious software.

ATS Team