Social engineering
Social engineering exploits human psychology, not systems, for unauthorized access.
Motivational triggers
Authority (comply with the boss), urgency (act now), social proof (everyone else is doing it), scarcity (limited supply), likability (we help people we like), fear (bad things if you don’t).
Impersonation family
- Impersonation: assume another identity, backed by researched details to earn trust.
- Brand impersonation: pose as a legitimate company using its logos and language.
- Typosquatting (URL hijacking): register a lookalike domain with a common typo.
- Watering hole: compromise a trusted site the target is known to use.
- Pretexting: feed a believable fabricated scenario so the victim fills in the rest. Train staff not to fill gaps for callers.
The phishing lineup
- Phishing: fraudulent emails to the masses.
- Spear phishing: a specific group, higher success rate.
- Whaling: executives (CEO, CFO), big rewards.
- Business email compromise: uses a real internal account to move money or data.
- Vishing: voice calls.
- Smishing: SMS text messages.
The indicators: manufactured urgency, unusual requests for credentials, mismatched URLs (hover to see the real link), strange sender addresses, poor spelling and grammar.
The response: train, report, analyze, inform users, triage any opened system, and revise controls after every successful attack. Run anti-phishing campaigns with remedial training for the people who click the simulations.
Frauds, scams, influence
Identity fraud uses your card; identity theft assumes your whole identity. An invoice scam tricks you into paying a fake bill.
Influence campaigns spread misinformation (false, no harmful intent) and disinformation (deliberately false, to deceive).
Other attacks
Diversion theft (distract, then steal), hoaxes (fact-check them), shoulder surfing (be aware of surroundings), dumpster diving (clean desk policy), eavesdropping (encrypt in transit), baiting (a dropped malicious USB; don’t use found devices), and piggybacking and tailgating (from physical security).