Did you know small businesses with less than 100 employees receive 350% more social engineering attacks than larger enterprises? But, it’s not just small businesses that are at risk: given how effective social engineering methods are, individuals across businesses of all industries and sizes need to be aware of the latest social engineering tactics and how to effectively identify and thwart them.
In sum, social engineering attacks exploit human psychology using fear, greed, urgency, helpfulness, or curiosity to bait victims into divulging confidential information. In some cases, the victim could even be coerced into sending money directly to the attacker or fraudster. These attacks usually begin when a user receives a socially engineered email (“phishing”), text messages (“smishing”), or phone calls (“vishing”) that deceive them into compromising their security, and personal information or to divert funds into unauthorized accounts.
As a result of Artificial Intelligence (AI) integration, which can help create compelling phishing communications as they impersonate trusted individuals – including their voices! – social engineering attacks are becoming more sophisticated and can be used to automate personalized attacks at scale. This growing sophistication means it’s also becoming more challenging for individuals to discern a legitimate email, text message, or phone call from a malicious outreach.
The aftermath of a social engineering attack can be devastating and result in financial loss, data breaches, malware infections, identity theft, operational disruption, reputational damage, and more.
So, how do you prevent and protect yourself from these attacks?
The single most effective tool in preventing social engineering attacks is education. More than ever, employees and all users of any company’s systems need to be informed about the latest cybersecurity threats. And with that, everyone must understand the importance of verifying the sender or source of any communication.
Here are some tips in order to do so:
- Verify the senders’ identity through the use of multiple channels: Verify any request for information or funds through a different communication channel. For instance, if you receive an email request, conduct a verification call or video chat.
- Contact known numbers/emails: Use contact information already on file rather than any provided in the suspicious or cold request.
- Check authorization: Consult internal directories to verify that the requester listed is, indeed, trusted, or refer to publically available phone directories to confirm phone numbers when possible. Confirm that the requester has the authority to make such a request by consulting your organizational hierarchy.
- Assess request validity: Turn a critical eye towards the content, and look for inconsistencies, unusual language, or errors that are not typical of the sender. If a request seems especially urgent, be weary: high-pressure tactics that demand immediate action without proper verification are commonly used by attackers.
- Review security policies and procedures: Follow established protocols and adhere strictly to company policies for handling sensitive information and requests.
- Document and report: Keep a detailed log of unusual requests and their verification process. Report any activity that seems suspicious and inform your security team or supervisor about any suspicious request, even if it turns out to be legitimate.
- Third-party verification: Employ third-party verification services, if available, especially for financial transactions or data access requests.
With the growing risks associated with social engineering comes a growing need to be aware of these attacks, and to stay informed about the latest tactics being used by bad actors. With that awareness comes the power to keep our employees, our businesses, and our friends and family safe.
