The Psychology of Deception ... Don't Take the Bait!
Have you ever heard of Social Engineering Fraud (SEF)? Possibly, you have heard about some of the SEF cyber criminal tactics not realizing this type of fraud actually has a name.
Cyber criminals who use psychological manipulation to scam a business or person is known as social engineering fraud. These human hacking schemes exploit an individual’s traits like trust, fear, helpfulness and deference to authority to bypass traditional security controls, for financial gain or access to a secure system.
SEF Core Principles
Create a sense of URGENCY using fake deadlines and/or account suspension threats to cause panic, which affects a victim’s rationale and ability to think clearly.
Act as an AUTHORITY by impersonating corporate executives, government officials and/or IT support desks to demand compliance.
Craft elaborate, believable backstories using information gathered from social media platforms to make the interaction feel normal and safe. This PRETEXT of TRUST sets the stage for a cyber criminal to psychologically scam you.
SEF Core Communication Channels
Cyber criminals launch social engineering fraud across numerous communication channels. Read more in this real SEF story from the FDIC.
-
Phishing = mass emails that are designed to look like reputable businesses (banks, tech companies), which contain malicious links or attachments.
-
Spear Phishing = specific individual's are targeted in an organization using personalized, heavily researched information.
-
Business Email Compromise (BEC) = a scammer hacks or spoofs a company executive’s or vendor’s email account. They intercept legitimate conversations and instruct accounting personnel to route standard wire transfers into fraudulent bank accounts.
-
Smishing = text messages (SMS) claiming to be package delivery alerts, fraud warnings or order confirmations containing malicious links.
-
Vishing = voice phishing phone calls. Fraudsters often use Voice over IP (VoIP) software to spoof trusted caller IDs and manipulate victims into revealing MFA codes or passwords over the phone.
-
Baiting = promises a reward (e.g., free software downloads or physically leaving infected USB drives in a company parking lot) to exploit curiosity or greed.
-
Quishing = utilizes fraudulent QR codes sent via digital messages or posted publicly to direct victims to credential-harvesting websites.
AIs Impact
Generative AI tools have significantly increased the scale and sophistication of these frauds. Criminals regularly use large language models to draft flawless, persuasive phishing emails devoid of typical spelling and grammar mistakes. Furthermore, bad actors use AI voice-cloning and video deepfake tools to impersonate trusted family members or CEOs during live phone calls or video meetings to authorize multi-million dollar transfers.
Preventive Defense Strategies
Businesses and individuals can reduce their exposure by establishing layered, human defense training, tactics and strategies.
1. Implement Out-of-Band Verification: Establish strict protocols that require employees to verify any request to alter banking details or send wire transfers using a secondary, completely separate communication channel.
2. Enforce Strong Authentication: Deploy Multi-Factor Authentication (MFA) across all corporate profiles. Train personnel to never share temporary MFA codes or tokens with anyone over the phone or via chat.
3. Conduct Continuous Awareness Training: Run regular phishing simulations and deepfake awareness exercises, so employees learn to spot behavioral red flags, such as unusual requests for immediate secrecy.
4. Review Insurance Policies: Standard commercial crime or cybersecurity policies often exclude coverage for financial losses stemming from voluntary money transfers. Businesses should verify with providers like Travelers or Chubb whether they need specific "social engineering fraud" endorsements to protect their cash assets.
