Vishing, smishing, and phishing. How to arm yourself against social engineering attacks

The human element

While technology plays a significant role in digital security, the human element remains a critical factor. According to the Verizon 2023 Data Breach Investigations Report, 74% of breaches involved the human element, which includes social engineering attacks, errors, and misuse. This statistic underscores the importance of educating employees about the various attack types and protection methods.

Probably everyone in your company has already heard about phishing, but that does not make it any less dangerous. On the contrary, phishing emails remain among the most prolific cybercrime techniques, where attackers attempt to deceive individuals into revealing sensitive information, such as passwords, credit card details, or personal identification, by posing as trustworthy entities. They typically use deceptive tactics, such as fake emails with links to websites that mimic legitimate organizations or individuals. As many might think, email isn't the only vehicle to deliver a scam, and lately, it has not been the most effective. Let's look at some other forms of phishing.

Vishing

Vishing, short for "voice phishing," involves scammers using phone calls or voice messages to deceive individuals into divulging sensitive information or making fraudulent payments. The sophistication of these attacks ranges from human impersonators to automated robocalls. Some scammers even employ call spoofing, using legitimate phone numbers to enhance their deception. The latest version of vishing includes deepfake calls, which can simulate a specific person's voice using AI tools, to make them even more convincing.

Smishing

Smishing, or "SMS phishing," means sending fraudulent messages via text or messaging apps to manipulate victims into performing specific actions. The messages typically contain links that direct recipients to malicious websites, login pages, or apps. Once accessed, these channels can extract personal information, including payment card details, or infect the victim's device with malware.

To effectively combat social engineering, keep common scams and their goals in mind:

Tech support: Scammers pose as IT support and ask users to provide their access login credentials, claiming they need to fix or update something on their computers remotely. This allows scammers to gain access to personal data and sensitive information. It is important to remember that IT or HR departments usually don´t ask employees to share private information over the phone, or through email.

Order/shipping confirmation: Victims receive fake links to track nonexistent packages or confirm orders, leading to the extraction of login credentials or malware installation. This can later be used to infiltrate other websites with the same logins. It is essential not to click suspicious links, and to check any incoming emails for the telling signs of a scam.

Program enrollment: Scammers pretend to be government program representatives, offering assistance with enrollment while collecting personal and financial data. This can include fake emails with invitations to webinars and other events, where users create accounts with a password. This is a problem primarily if the person uses the same password for different accounts because it gives the scammer a free pass to hijack them.

Account verification: Scammers impersonate, among other financial institutions, entertainment platforms such as Netflix, or digital stores, where users have personal profiles. They claim unusual activity on the account, lead users to fake websites, and request login information for verification purposes.

Winning a prize: Scammers inform individuals of a contest victory, and then request personal information or access to their bank accounts. Personal data can then be extracted from the accounts, potentially causing significant financial damage. It is essential to verify any contest victories through the official organizer.

Demands for payment: Scammers pose, for example, as government agency representatives, threatening with fines or arrests if payment is not made. Other examples include the attacker posing as the company's CEO, asking for quick payment from one of the employees, or suppliers contacting employees, demanding compensation for packages and goods.

Basic rules for employees

There are several good practices employees can adopt to protect themselves against various types of social engineering:

1. Pause, think, and act: Scammers rely on the urgency to manipulate victims. Take time to evaluate requests, and avoid hasty actions. Avoid clicking on links in text messages, and visit the organization's official website to verify the communication's legitimacy.
2. Be suspicious of unknown numbers: Verify calls or text messages from unfamiliar or suspicious numbers. Avoid disclosing any personal information or clicking unknown links within messages. This helps you minimize the chances of falling victim to such scams.
3. Keep personal information private: Never disclose sensitive information such as account numbers, Social Security numbers, passwords, or Multi-Factor Authentication (MFA) codes to unknown individuals over the phone or in a message. Legitimate organizations would not request such details through unsolicited calls or messages.
4. Verify identity: If you receive a message from someone claiming to represent a company or government agency, avoid interacting directly. Instead, independently verify their authenticity by contacting the organization using the official contact information available on their website.
5. Enable strong security measures: Use strong and unique passwords to protect your accounts. Consider utilizing password generators and managers to create long and complex passwords or passphrases, and store them securely. Use Multi-Factor Authentication (MFA) whenever available to add an extra layer of protection.

Digital security awareness training is vital to protecting against cyber threats. Download the free Phishing playbook for employees, and share it with your team.