Types of Social Engineering Attacks [Recent 2020 Scams]
Be real careful- since CoVID these computer scammer techniques have increased
What Is Social Engineering?
In social engineering attacks, scammers impersonate trusted officials, like customer service representatives at a bank, to con unsuspecting victims out of millions of dollars every year. According to the
FBI's 2018 Internet Crime Report, over 25,000 individuals reported being a victim of one of several types of social engineering attacks, resulting in nearly $50 million in losses. And that’s only reported scams — true numbers are exponentially higher.
The most prevalent social engineering scams are those taking place over the phone or through malicious links in emails. Well-crafted schemes carry all the signs of legitimacy, using personal details collected from the dark web or even from social media to catch even the most careful individuals off-guard. Though the spotlight has been on how fraudsters use stolen data for account originations, data breaches also give social engineers more personal information to exploit in a social engineering attack, improving their ability to target individuals and commit fraud in the digital age.
Types of Social Engineering Attacks
There are two main types of social engineering attacks. The first type is credential or personal information harvesting, designed to steal sensitive information from the user for the purpose of selling this information on the
dark web to be later used for account creation or account takeover. Examples are phishing, vishing, and smishing. The second type, which is more sophisticated, involves coercing the user to defraud themselves in real time, via a phone scam. Examples include voice scams and remote access tools (RAT) attacks. These attacks pose significant risk to businesses worldwide, including banks and insurance companies.
Phishing is the most common form of social engineering attack, accounting for
90% to 95% of all successful cyberattacks worldwide in 2017. Attackers disguise false communications to appear as though they are coming from a legitimate source. Unwitting victims may then click a false link and install malware on their device or enter in personal information, such as credit card info, that the hackers then steal.
Today, fraudsters are developing targeted attacks specifically designed to manipulate and trick a particular group of users rather than the large, bulk email attacks of past years. Some of the top targets for phishing attacks are popular payment providers and financial institutions. Vade Secure, a security company that keeps a running
list of the most-imitated brands, found that PayPal took the top ranking in the third quarter of 2019, followed by Microsoft and Netflix.
Vishing
Vishing, or phone based phishing is a common type of credential or personal information harvesting. The scammer will impersonate as the IRS or another tax related official, an IT professional, a tech support or car warranty company, claiming that something is wrong, or expired with your account and they will ask for information to verify your account and then additional information to be able to fix the situation, whether personal information and credit card information or credentials. Some scammers use positive psychology, informing the victim that they have won a vacation or some other good news, asking them to provide personal information to be able to receive the prize. In the United States, the Federal Trade Commission reported that 77% of its fraud complaints involve contacts by telephone, of which social engineering is a subset.
Smishing
Smishing, or SMS phishing, is an emerging form of social engineering attack that cyber criminals are using to target victims on their smartphones. In smishing, fraudsters use text messaging to trick users into giving out confidential information or to download malware or a virus onto their phone. Fraudsters are also using smishing to bypass two-factor authentication and multi-factor authentication (MFA). In 2019, the
FBI issued a warning about the vulnerabilities of MFA to social engineering.