Watch Out for These 5 Types of Social Engineering Attacks

Phishing is one of the most popular and common forms of social engineering. Hackers distribute fraudulent communication via email, SMS, or other mediums to manipulate the victim into clicking on a malicious link, downloading infected attachments, or sharing sensitive data, such as their account credentials. Hackers typically use emails for phishing with subject lines that create a sense of urgency. While phishing attempts can sometimes involve outrageous demands, a lot of hackers today are crafting more convincing messaging. For more information on phishing, check out our blog post Top 3 Red Flags of Phishing.

Business email compromise is a type of spear phishing campaign where attackers send spoofed emails impersonating an organization’s CFO, CEO, or another senior executive to get your users to make wire transfers, purchase gift cards, or share confidential data.

For instance, say a new entry-level employee joins your business, they can become a target for social engineering attacks. Most people share job updates on LinkedIn and a hacker could use this information. Once they identify your company’s leadership, there are many ways for a hacker to guess your corporate email address. With all this information, the hacker may target this new employee with spoofed emails impersonating your CEO. The email messaging may create a sense of panic or urgency to get the employee to perform an action without properly looking for signs of phishing, such as an incorrect domain in the sender’s email address.

BEC attacks are a growing and costly threat to businesses. According to data from the FBI’s Internet Crime Complaint Center, BEC resulted in total losses of nearly USD 2.4 billion for victims in 2021. BEC attacks are dangerous because they do not include a malicious link or attachment, so they can go undetected by typical email security systems. You need your employees to equipped to detect and report a BEC incident.

Below is an example of a BEC of our CEO/Founder, David Gravel. This spoofed email was sent to employees in hopes that someone would fall for the scam and purchase gift cards to send to the attacker. Notice the urgency of the subject line. 

Attackers may pretend to be a bank official, tax authority, tech support personnel, airline official, among others, to deceive users into sharing sensitive information, such as credit card information or date of birth. Hackers may even call your employees pretending to be a known third-party vendor or event organizer with convincing scenarios to get them to perform an action.

It’s important to note that hackers have a lot of tools like voice-altering systems, fake phone numbers, or VoIP technology to create more convincing false identities.

According to the Verizon 2024 Data Breach Investigations Report, 68% of breaches involved a non-malicious human element, like a person falling victim to a social engineering attack or making an error. This shows the importance of comprehensive employee security awareness training around social engineering. Your people are your first line of defense, so if they are not aware of such attacks then they will not be able to stop them. So, educate your employees on the different types of social engineering, how to identify the red flags of such attacks, and how to report them internally for further action.