In this article:
Hackers might be able to break into computers, but well-trained attackers can trick you into willingly giving them information and money. These types of tricks are commonly called social engineering. When a person or company says they got hacked, there's usually an element of nontechnical trickery involved.
Learning how to detect various types of social engineering can help protect you from the latest scams and most common types of fraud. And as artificial intelligence (AI) tools become more mainstream, you'll have to be increasingly vigilant and aware of these types of threats.
What Is Social Engineering?
Social engineering is the broad term for the psychological techniques criminals use to scam others. Instead of attacking a computer or device directly, these criminals use social skills to exploit human emotions and ultimately persuade them into divulging personal information or money.
The term is most commonly used within cybersecurity when describing deception that takes place online or over the phone. For example, cybercriminals might use social engineering to try to get you to click on a link, give them your password, send them money or share your personal information.
How Does Social Engineering Work?
Social engineering attacks often work by building trust, instilling fear, relying on reciprocity or creating a sense of urgency. The specific approach can vary, but attacks often follow a common four-step process:
- Research: Attackers may research an individual to learn about their business, job, life, family and friends. They may use the information to tailor their fraudulent messaging or scam approach.
- Contact: Initial contact might come from a call, text, email, social media message or in-person interaction, where the attacker poses as a trusted source. Alternatively, the criminal may bait you into reaching out to them first, such as placing an ad for a fake job.
- Interaction: Using various techniques, the attacker manipulates you into revealing personal information, sending money, allowing access to financial accounts or doing something else for their gain.
- Move on: Once the attacker gets what they want, such as money from your bank account, they move on to the next victim.
Types of Social Engineering
Social engineering can take many forms, but here are some of the most common types.
Phishing
Phishing is a broad type of scam involving electronic messages that appear to be from a legitimate source. In a phone call, text message or email, you may be asked to do something like clicking a malicious link or responding with sensitive information. If you fall for the trick, the scammer may be able to steal money or sell your personal data online.
Example: You receive an email that appears to come from your bank warning that your account is locked and asking you to click a link to verify your login information.
Vishing
Vishing, or voice phishing, is a type of phishing attack where the criminal specifically uses phone calls, voicemails or robocalls to impersonate a trusted person or organization.
Example: A caller claims to work for the IRS and says you must immediately pay an overdue tax bill to avoid arrest.
Smishing
Smishing is a phishing attack conducted through SMS text messages. Scammers may use urgent or enticing messages to get you to click a malicious link, call a phony organization or download malware.
Example: You receive a text claiming you have an unpaid toll and need to follow a link to avoid additional fees.
Scareware
Scareware is a type of malware scam that often comes in the form of emails or pop-up browser messages. Through alarming messages or warnings, the scammer tries to frighten you into downloading malicious software, visiting a website or paying for a service.
Example: A pop-up warns that your computer is infected with several viruses and directs you to download software to remove them.
Pretexting
The criminal creates a compelling false story or identity, known as a pretext, to persuade you to offer help or provide information. The message may ask you to send money or information to help a friend, relative, charity or someone else in need.
Example: A scammer poses as one of your trusted friends who's on vacation and lost their wallet. They ask you to wire them money to get back home.
Baiting
With baiting, the scammer offers you something enticing such as a free download, reward, prize, job offer or something else you might want. The goal is to get you to take an action that compromises your information or device.
Example: Someone leaves infected USB drives labeled "Payroll" in an office parking lot, hoping an employee will plug one into a work computer.
Business Email Compromise (BEC)
Business email compromise (BEC) involves impersonating a trusted business contact, such as an executive, employee or vendor, to trick someone into sending money or sensitive information.
Example: An employee receives an email that appears to come from the company's CEO. It contains an urgent message to pay an invoice to a new bank account.
How to Protect Yourself From Social Engineering
Because social engineering relies on psychological manipulation, learning to detect and avoid these cons is the best way to stay safe. Here are a few steps you can take to help prevent social engineering attacks.
- Be extra cautious if you feel scared or pressured. Attackers often imitate authority figures to scare victims or create a sense of urgency. If you're feeling scared or pressured, pause and consider calling a trusted family member or friend for a second opinion.
- Don't trust the name on an email or caller ID. Attackers can spoof these names and turn them into almost anything. Look up the person's or organization's contact information and reach out to them for clarification.
- Know that AI can mimic people and create convincing content. Scammers can use AI to mimic someone's voice, create deepfake videos, and write realistic messages or emails. This makes it harder to spot scams. Be skeptical of people who contact you and ask for something, even if they look and sound legitimate.
- Keep your devices updated. Regularly update your computer, phone and other devices with the latest security patches. This can help protect you from malware.
- Don't immediately click on links. If you receive a link from an unfamiliar source or a suspicious message from someone you know, it's best not to click. This helps you avoid downloading malware.
- Use unique passwords and multifactor authentication. Unique passwords can help protect your accounts if one password is compromised. Multifactor authentication (MFA) can help keep someone out of your account even if they have your password.
- Be wary of specific payment requests. Scammers tend to ask you to send money by gift card, wire transfer, cryptocurrency or peer-to-peer app because it can be difficult to reverse these transactions.
What to Do if You've Been Scammed Through Social Engineering
If you realize you've fallen for a social engineering scam, acting quickly could help limit the damage. Take these steps to secure your accounts, finances and personal information.
1. Stop Communicating With the Scammer
Stop sending money or information to the scammer. Consider saving messages, receipts and other records in case you need them when reporting the scam.
2. Secure Your Accounts
Update your login and security credentials on any accounts that were compromised. This may include usernames, passwords, security questions and PINs. If you reused the same password elsewhere, change it on those accounts as well. Create strong, unique passwords and turn on multifactor authentication when available.
3. Contact Your Financial Institutions
If you sent money or shared financial information, contact your bank, credit card issuer or other financial institution right away. Explain what happened and ask whether the company can stop or reverse the transaction. Your bank or card issuer may also replace any compromised credit or debit cards.
4. Check for Identity Theft
Checking for identity theft after a scam can help you spot potential fraud and take action as quickly as possible. Start by reviewing your credit reports and financial account statements, and look for transactions or accounts you don't recognize.
If you discover someone has used your personal information, reach out to your financial institution. You have the right to place a fraud alert or credit freeze on your credit reports to help prevent new accounts from being opened.
5. Scan Your Devices
If you clicked a suspicious link, opened an attachment or downloaded software, run a security scan on the affected device. Remove any malware or suspicious programs you find, and update the security software if needed. It's also a good idea to change your passwords and enable multifactor authentication.
6. Report the Scam
Report the scam to the website, app or company where it occurred or to the organization the scammer impersonated. This can help the organization investigate the scam and potentially protect other people from similar attempts.
For internet-related scams, you can file a report with the FBI's Internet Crime Complaint Center (IC3) at IC3.gov. You can also report the identity theft at IdentityTheft.gov and get a personalized recovery plan.
The Bottom Line
Social engineering can take many forms, from phone calls to emails, texts and even in-person interactions. With each method, a scammer contacts you and manipulates you into somehow compromising your digital security.
Understanding how social engineering tricks work and exercising caution can go a long way toward preventing these attacks. Limiting the information you share online can also help. You can get a free dark web scan and free privacy scan to see what information attackers may be able to buy or access online.