Social Engineering 101: Understanding Common Tactics

With potential breach costs for small businesses ranging from $120,000 to $1.24 million, and a 70% chance of experiencing an attack, can you afford to ignore the human element of cybersecurity? It is not a matter of if, but when.

The Art of Deception

How do cybercriminals bypass complex security systems? The answer lies in social engineering – a tactic that exploits human psychology to trick you into revealing sensitive information. Imagine a hacker, not breaking through firewalls, but charming their way into your trust. They might pose as your IT support, a friendly colleague, or even a desperate customer. Their goal? To manipulate you into handing over passwords, financial data, or access to your company's most valuable secrets.

Cyber criminals follow a 4-step process when conducting a social engineering attack.

1. Information Gathering: Researching targets to identify vulnerabilities.

2. Establish Trust: Building rapport to lower defenses.

3. Exploitation: Manipulating trust to gain access or information.

4. Execution: Utilizing the gained access for malicious purposes.

To understand how these tactics play out, consider this common scenario, you start a new job and add that to your LinkedIn Profile.  Hackers, using automated tools, spot the update. They send you an email, pretending to be a senior figure at your company, asking for a simple favor – print a document, set up a meeting. Engage, and they escalate, requesting gift cards or sending malware. This is how social engineering targets new employees.

Cyber criminals have built databases of information about all of us, and they use this information to create more and more convincing attacks.

Types of Social Engineering

The methods used to manipulate individuals are as diverse as the targets themselves. Beyond this LinkedIn scenario, social engineers employ a variety of attack types, each with its own unique approach.

Phishing Attacks

At its core, phishing relies on deception and a sense of urgency. Cyber criminals send out fraudulent emails impersonating legitimate organizations like banks, online retailers, or social media platforms. These messages are designed to:  

• Create a sense of urgency or fear: Phishing emails often claim that your account has been compromised, or that you need to take immediate action to avoid a negative consequence.  
• ‍Mimic legitimate communications: Attackers meticulously replicate the look and feel of official communications, using logos, branding, and even language that appears authentic.  
• Encourage clicks on malicious links or attachments: These links or attachments lead to fake websites that steal your login credentials or download malware onto your device.

Phishing attacks are typically mass-distributed, aiming to trick as many recipients as possible. It is cheap to send out large quantities of these emails and hope that they get a small number of people to engage.

Spear Phishing

Spear phishing is what happens when the phishing bait is crafted with laser precision and aimed directly at you. It is a far more dangerous and sophisticated cyberattack. Imagine receiving an email that looks exactly like it is from your boss, or a message from a trusted vendor, complete with details only they would know. That is the hallmark of a spear phishing campaign.

Attackers invest time in researching their victims, scouring social media, company websites, and even public records to gather personal details. Additionally, attacks on your partners can become attacks on you, as they gain your information and access through those relationships.

The information gathered is leveraged to craft convincing messages, exploiting your trust and sense of familiarity.

This is not just about stealing passwords; it is about gaining access to sensitive data, deploying ransomware, or even manipulating you into transferring funds.

Spear phishing is a constant threat, and attackers are continually evolving their tactics.

Vishing Attacks

Vishing, or voice phishing, is a social engineering attack that uses phone calls to steal your information. Unlike email phishing, it relies on the immediacy and perceived authority of a phone conversation. We have all heard about the fake IRS and police calls.  

Recently, I experienced it firsthand. I received a call from someone claiming to be my credit card company, saying my card was used to buy a washer/dryer on eBay. When I said I didn't make the purchase and they asked for my card number, I knew something was wrong. I told them I would call back using the number on my card, and when they argued, it confirmed my suspicions.

Smishing Attacks

Smishing, or SMS phishing, uses text messages to deceive you into sharing sensitive information or clicking harmful links. An example is the recent surge in text messages claiming unpaid tolls. These messages often appear authentic, especially if you have recently driven in the area.

Responding to these texts by making a payment compromises your financial security and signals to scammers that you are a susceptible target.

Who doesn’t like a freebie? But these free offers can mask malicious links. Clicking to get the reward prompts a quick download of malware, compromising the safety of that employee’s device and your entire network.

Impact of AI on Social Engineering

Artificial Intelligence (AI) has significantly amplified the sophistication and scale of social engineering attacks. Here's how:

Hyper-Personalized Attacks

• Data Mining: AI-powered data mining gathers personal detail from sources like social media, online profiles, and news articles to create targeted attack messages.
• Voice Cloning: These tools can mimic the voices of trusted individuals making vishing attacks far more convincing and difficult to detect.

Increased Scale and Automation

• Automated Phishing Campaigns: AI can automate the creation and delivery of personalized phishing emails and messages at scale, targeting millions of individuals with customized content.
• 24/7 Operations: AI-powered bots can operate continuously, tirelessly searching for vulnerabilities and launching attacks around the clock.

Evolving Tactics

• Predictive Analysis: AI can analyze past attack patterns to predict future trends and vulnerabilities, allowing attackers to adapt their strategies in real-time.
• Emotional Manipulation: AI can analyze voice patterns and language to identify and exploit emotional cues like fear, urgency, or excitement, making attacks more effective.

With increasingly sophisticated AI, identifying fraudulent requests is a challenge. If you have any doubt, call the company directly to confirm, using a known number.

Social engineering is getting more sophisticated, the advent of AI has allowed cyber criminals to increase the speed and volume of attacks.  There are things you can do to protect your business; we cover that in Part II — Social Engineering 101: How to Safeguard Your Business.

If you want to talk to an expert about how you can protect your business, let us know.  Our friendly experts are here to help you put strategies in place to make it harder for your business to be a target.

Follow us on LinkedIn.

‍

Originally Published: January 1, 2022
Revised & Updated: August 1, 2023

Revised & Updated: April 29, 2025

‍