What are social engineering scams?

What are different types of social engineering scams:

How to identify a social engineering scam?

How to protect yourself from social engineering scams?

Where to report a social engineering scam?

Conclusion

Social Engineering Scams

What are social engineering scams?

Social engineering scams are tactics used by scammers to gain the trust of individuals and manipulate them into revealing confidential or personal information. Bad actors exploit human psychology by creating fear, urgency, or offering false promises to deceive individuals into sharing sensitive details such as passwords, bank information, or identification numbers. Social engineering scams are reported in countries like the US, UK, India, Canada, Australia, Nigeria, China and the Philippines.

In India, many individuals were defrauded last year by scammers posing as officials from the customs department, with some victims losing their entire life savings. The threat actors called unsuspecting people, claiming that a parcel addressed to them had been intercepted and contained MDMA (a narcotic substance) along with their identification documents and other illegal materials. They warned that the victims could face serious legal consequences. Under the pretext of monitoring, scammers instructed victims to transfer all their funds to a so-called secure account and then disappeared with the money. These criminals kept victims on the phone for hours, isolated them from friends and family, and used fear tactics to force compliance, leaving individuals paranoid and entirely under their control. This scam was widely known as fedex scam or courier scam.

This is a severe example of social engineering, where scammers addressed individuals by name and sometimes even read aloud their unique identification number (Aadhaar in India). They posed as authoritative figures capable of intimidating people, establishing a believable pretext before accusing them of serious crimes they had never even heard of. By instilling fear and confusion, the scammers manipulated their victims into complying with demands and ultimately extorted large sums of money.

In Chennai, a 72-year old woman was scammed by callers who claimed her phone number was linked to illegal Hawala accounts. Posing as a cybercrime officer, one scammer said a parcel in her name with drugs and fake documents was seized. They threatened arrest and tricked her into transferring ₹4.67 crore to a fake RBI account which is around $560,000 USD.

What are different types of social engineering scams:

Phishing:

Bad actors mimic government organizations, courts, banks, telecom companies, and other legitimate entities and send emails to potential victims. These messages are designed to fool individuals into providing scammers with their personal information such as bank details, IDs, passwords, or one-time passwords, which are then used to financially drain their targets.

Smishing (SMS Phishing):

Scammers send harmful, malware-laden texts to individuals, concealed in the form of an important official message, that pressure targets into disclosing confidential or sensitive information which is then used to defraud them.

Vishing (Voice Phishing):

With voice cloning, vishing scams have become even more complicated and almost impossible to detect. In a vishing scam, scam artists impersonate government officials or even someone you love and deceive you into making decisions that can harm you financially or lead to identity theft.

Pretexting:

In a pretexting scam, scammers pretend to be someone else and deceive targeted individuals through a fabricated story into revealing information or performing certain actions that ultimately benefit the scammer.

Baiting:

In this type of social engineering scam, threat actors put out a bait for victims, a sort of false promise to lure them into disclosing company secrets or personal information. The bait is something attention grabbing like free software, music, or a USB drive loaded with malicious software.

Tailgating:

Scammers enter into a facility unauthorized, taking advantage of a lack of security or by posing as a delivery agent to gain access to sensitive information or carry out malicious activities.

Whaling:

As the name suggests, in whaling, cybercriminals target people who are in an important role in an organization, like the CEO or executives just below them, to access the company’s sensitive information, release funds, or carry out other high-impact actions.

Deepfakes:

New age scammers are using hard-to-detect audios, videos, and images that look and speak like real people and manipulate their victims into revealing personal information, transferring money, or taking actions favourable to the scammers.

Scareware:

Scammers try to instill panic and confusion by scaring people or threatening them, like saying their ID has been misused in a crime and now they are under arrest, or that their loved one has had an accident. Then there are bank-related scams about account closures or freezes.

There are many such scams where the idea is the same: to create anxiety so the person is unable to think clearly or act rationally.

How to identify a social engineering scam?

Unsolicited Communication:

It often starts with a simple phone call, text message, email, or social media interaction. Scammers initiate contact and gradually follow a scripted approach that ultimately leads to requests for sensitive information or money.

Threat and urgency:

A loved one being in an accident, someone held against their will, a penalty for missing jury duty, or an urgent request to share an OTP to avoid account closure, these are just a few of the many tactics scammers use to trick individuals. Be cautious in such situations: stay calm and think carefully before taking any action.

Unusual payment requests:

If a caller asks for payment through cryptocurrency or gift cards, it’s a red flag. Scammers use these methods to cover their tracks, and no credible agency would ever request payment this way.

Generic greetings:

Official communication will include your name, not generic greetings like 'Dear customer' or 'Dear user’.

Poor grammar:

Official emails generally do not contain spelling mistakes or poor grammar. If you receive a message that appears to be from an official source but contains such errors, consider it suspicious and verify its authenticity through trusted channels.

Malicious links and websites:

More often than not, scammers create websites that closely resemble official ones. Always double-check email addresses and website URLs for misspellings, and cross-verify them with the official sources you know are trustworthy before taking any action.

How to protect yourself from social engineering scams?

Besides keeping yourself updated about ongoing scams, it is important to never share your sensitive information with anyone and to act with patience during such situations. Here are some of the key ways you can protect yourself and your family:

Be aware: Educate yourself and others about ongoing scams and the tricks scammers are using to defraud people.
Do not share sensitive information: If you receive an unsolicited request for personal information like IDs, passwords, bank details, OTPs, or any other financial information, treat it as a red flag
Use official channels of communication: If you suspect that a communication from a company or person is suspicious, verify their authenticity through official channels, such as a verified website, phone number, or an email address.
Do not click on random links: Make it a rule, do not click on links sent by unknown senders. These could be phishing links meant to steal your personal information.
Use complex passwords: Change your passwords regularly and use unique passwords for each account. Including a mix of uppercase and lowercase letters, numbers, and special characters makes your passwords harder to crack.
Enable multi-factor authentication (MFA): For an additional layer of security to our account, enable multi-factor authorization as it significantly reduces the risk of unauthorized access.
Limit what you share on social media: Scammers make use of the data you share on social media. From cloning your voice to misusing information about your friends and relatives, they can exploit such details to cause you harm.
Download the Truecaller app: Truecaller protects individuals' time and money by filtering out spam messages, blocking spam numbers, and identifying unknown callers. It also helps detect fraud and scam attempts, and its new AI call scanner feature can be activated if a call seems suspicious. If the call is AI-generated, the app will let the user know, protecting them from voice scams.