Common Social Engineering Red Flags your staff must learn to recognize
Most organizations think they have robust cybersecurity strategies and policies in place. However, as cyberattacks have grown to be much more sophisticated, so too have social engineering techniques. However, there are some red flags every employee should learn to recognize to avoid falling victim to social engineering attacks.
It is common to miss out on the human side of cybersecurity risks. Employees might be aware of common threats but may not take a closer look at official-looking email messages coming from partners, vendors, colleagues, or institutions they deal with regularly.
Here we explain some of the common social engineering red flags every employee should lookout for.
On this page:
What is Social Engineering?
Social engineering refers to manipulating people to do the desired or to reveal confidential information. It applies to deception for either gaining access to a system or information collection. It can attribute to simple actions like opening attachments or clicking on a link. For example, an email may ask you for information like account numbers, usernames, and passwords in some cases.
In many cases, the targeted employee is unaware that they’ve unknowingly granted access to a corrupt party, leaving the entire organization’s data and systems vulnerable to hacking. Social engineering is done in many possible ways, including phishing, business email, vishing, Smishing, pretexting and more.
To carry out their attacks, social engineers employ a range of strategies.
Most social engineering assaults begin with the attacker conducting a study and survey the potential victim. For example, if the target is an enterprise, the hacker may acquire intelligence on the organizational structure, internal operations, industry jargon, and potential commercial partners, among other things.
Related: 5 Social engineering techniques that exploit business employees
Social engineers frequently target the behaviors and patterns of employees with access, such as a security guard or receptionist; attackers can check social media accounts for personal information and analyze their behavior online and in person.
The social engineer can then develop an attack based on the information gathered and exploit the vulnerability discovered during the reconnaissance phase.
If the attack is successful, the attacker obtains confidential data such as Social Security numbers and bank account or credit card information; makes money from the targets, or gains access to secured systems or networks.
The data breach of security company RSA in 2011 was an example of a successful social engineering attempt. Over two days, an attacker sent two different phishing emails to small groups of RSA workers.
The emails were labeled “2011 Recruitment Plan” and included an Excel file attachment. The spreadsheet contained malicious code that, when opened via an Adobe Flash vulnerability, installed a backdoor.
Email-based Social Engineering Red Flags
One of the primary modes of social engineering attacks is phishing emails. Most phishing emails get through advanced spam filters, entering the employee’s inbox and appearing to be an important business or official email message requiring attention.
Business owners and staff must be aware of red flags to identify threats in this form and avoid falling victim to social engineering scams.
Sender
The sender’s email address is one of the best ways to identify a social engineering red flag. Check the domain and verify that the email address belongs to the company the person claims. Social engineers try to conceal the right domain by using misspells and false names. If a mail originates from a domain that looks like a real one, it can be malicious.
Once you verify the sender’s legitimacy, see if the email makes sense. If you don’t usually communicate with the person, there is a possibility the sender’s email has been hacked to attack targets easily.
Another red flag is receiving emails from somebody outside the company not related to your job.
Sometimes, the sender’s name may look familiar, but the email address seems odd. The email may contain hyperlinks or attachments. If you have any suspicions before opening any attachments or links in the email, it would be sensible to contact the sender for confirmation.
Recipient
Apart from the sender address, the address to which the email is sent should be evaluated. If the mail is sent to a random mix of people that don’t seem related, it can be a phishing attempt.
See if there is a pattern in the name of the people on the list. Your name might be cc’d with some others that you don’t know. Avoid opening such emails and attachments.
Subject
Both legitimate and malicious emails use the subject to catch your attention and give an idea of the content. However, phishing emails generally aim to play with human emotions to increase the chances of opening and taking action. Check if the email’s subject tries to create a sense of fear, greed or urgency, or any other strong emotion. This is a clear red flag that employees should be careful about.
The subject of the email should also be evaluated on a personal level. If you receive a mail from a verified sender, see whether the subject matches the sender’s context. A red flag for email subject is a conversation you can’t relate to. Social engineers try to use uncertainty with a sense of urgency to play with human emotions. Employees should avoid rushing to take action, thinking they have forgotten something.
Date and Time
Another easy red flag for spotting a social engineering attempt is the date and time of the email. For example, if the content of the mail greets you good noon in the nighttime or you receive a mail that looks like a work message at midnight, it is likely to be a phishing email.
However, if you feel your colleague could be working on a project late at night, it is a good idea to call and verify the email request.
Content
The body of the email is where the social engineers try to encourage you to perform some action. This can be anything, opening an attachment, clicking on a link, or doing something in the interest of the attacker. Employees should consider evaluating the call to action in an email to identify a phishing attempt.
Check whether the content tries to induce emotions like fear, urgency, or greed. Another thing is to look at the salutation in the email. If it is a generalized reference like ‘valued customer’, it should be deemed as suspicious.
Links
Links are a common way social engineers encourage recipients to visit their malicious website. The best practice is to avoid clicking on links and instead visit the sender’s website and use internal links for navigation. As this takes time and effort, most people prefer clicking on links if they look genuine.
Social engineers utilize several techniques to make malicious links appear legitimate to recipients. A common way is to use a different display text for a link address. Employees should be encouraged to mouseover links to check that it matches the display text to verify its legitimacy. If you see that the target address does not point to the correct domain, it is undoubtedly a matter of concern.
Another red flag is when the email contains a link but no subject or content. Some other social engineers use misspells to convince recipients that the link is legitimate though they are completely different websites and domains owned by others.
Attachments
Files attached to emails are helpful tools for business but are also an excellent vehicle to distribute malware. Before opening an attachment, see whether or not it matches the subject or content of the mail. If you notice that the attachment is a different file type than what you generally work with, it may contain malware.
Staff members should be encouraged to be careful about email attachments. Before opening any files, every employee should ask whether or not he would expect an attachment from the sender.
For example, if you never receive a file from a sender, it is worth checking before opening one. If you always receive a particular type of file from a sender, and it is suddenly something else, it is best to check its authenticity before opening.
Phone-Based Social Engineering Red Flags
Though most attackers use phishing emails, an in-person or telephonic approach seems to be more effective in some cases. Let us talk about some common red flags for social engineering attempts through telephonic conversations.
Dropping Names
Most of us tend to respect authority and are likely to follow instructions coming from these people. Social engineers exploit this tendency by dropping names of authority figures and claiming that the request originates from such a figure. A strange person claiming to be close to an authority figure is a social engineering red flag your staff should be aware of.
Avoiding Questions
Though social engineers try to learn as much as possible about their role, there is some information they are not aware of about the legitimate role. When asked some questions, they will try to run away from the conversation. Such responses are red flags for social engineering.
Mistakes
A simple yet effective social engineering technique is to make a mistake to manipulate the target to do something out of the ordinary. A little preparation would help create situations where you could end up revealing details you are not supposed to disclose. Another common method is to make false statements to encourage the listener to correct, thereby revealing sensitive information.
Requesting Information
A social engineer aims to acquire information, and the best way is to ask questions. If somebody starts requesting sensitive information, you must verify that he is authorized to ask for it before revealing anything.
No Callback Number
It is straightforward to spoof the caller ID number to appear to be calling from a trusted source. However, when trying to call back, the call goes to the original owner. If a caller refuses to give you a callback number, it is a red flag about the person’s genuineness and should be handled carefully.
Preventing Social Engineering
There are several ways that businesses can use to prevent social engineering assaults, including the following:
- Ensure that information technology departments do social engineering penetration testing regularly. This will assist administrators in determining which types of users are more vulnerable to various kinds of assaults and which staff require additional training.
- Begin a cybersecurity awareness training program, which can help prevent social engineering assaults. Users will be less likely to become victims if they are aware of the characteristics of social engineering assaults.
- Use secure email and web gateways to scan emails for harmful links and filter them out, lowering the risk of a staff member clicking on a malicious link.
- Keep anti-malware and anti-virus software up to date to help prevent malware from being installed in phishing emails.
- Keep endpoint software, and firmware fixes up to date. Phishing, social engineering, password best practices, and secure remote work practices are important subjects to cover in cybersecurity training.
- Maintain a list of employees who handle sensitive information and enable sophisticated authentication methods for them.
- Use 2FA to access critical accounts, such as a confirmation code sent through text message or voice recognition.
- Make sure that employees do not use the same password for personal and business accounts. If a hacker conducting a social engineering assault obtains the password for an employee’s social media account, the hacker may access the employee’s work accounts as well.
- Use spam filters to identify which emails are likely to be spam. A spam filter may have a blacklist of suspect Internet Protocol addresses or sender IDs. It may detect suspicious files or links and evaluate the content of emails to determine which are likely to be fraudulent.
Conclusion
Social engineering is all about manipulating the psychology of targets to get them doing what the attacker wishes for. All your staff members should be trained to protect themselves against such attacks by slowing down, being careful, and verifying.
Most attempts will fail if the recipient verifies that the person was not authorized to access the requested information. The red flags described here should help employees identify potential threats from social engineers and protect the organization’s sensitive data.
