COVID-19 Cyber & Fraud: Social Engineering

Phishing

Phishing uses a fake email from a third party to trick them into clicking on a link or providing sensitive information.

Vishing

Vishing uses the phone instead of email. Scammers ask for personal information such as date of birth, address, financial information, etc.

Can you always trust who is on the end of the line? When in a conversation with someone you don’t know, before answering a question make sure they need to know the information that they’re asking about.

Pretexting

Pretexting is another form of social engineering where attackers focus on creating a good pretext, or a fabricated scenario, that they use to try and manipulate victims.

Don’t get caught up in the story being told. A sense of pressure should be a red flag. Ensure that staff know what procedures they must follow e.g. urgent request to transfer funds.

Baiting

Received an email or text with the promise of a voucher for a free coffee or discount at a local store – what could possibly go wrong?

Unsolicited emails containing links should always be treated with suspicion and make sure your anti-virus is up to date.

Tailgating

Tailgating is used to gain access to a secure building by blending in and making you think that the hacker truly belongs there. Workmen wearing hi-vis often pass unnoticed in the work environment, why would they be there if they didn’t need to be?

Educate staff to be on their guard. Look for ID and passes and encourage staff to ask strangers in the workplace who they are there to see.

What do we know about you?

Serious social engineers, will do deep background searches and reconnaissance on their targets before moving. This includes both verbal communication and social media like Facebook or Twitter.

Be aware of the information you are giving out and your digital footprint. Review your privacy settings.