What is social engineering attack example?

The biggest weakness in a cybersecurity strategy is humans, and social engineering takes advantage of a targeted user’s inability to detect an attack. In a social engineering threat, an attacker uses human emotion (usually fear and urgency) to trick the target into performing an action, such as send the attacker money, divulge sensitive customer information, or disclose authentication credentials.

Tricking users into divulging sensitive information is nothing new in the world of cybersecurity. The only thing that’s changed is the method of attack, the stories used to obtain information, and sophisticated attacks from organised groups incorporating other threats such as phishing. The term social engineering was first used in 1894 by Dutch industrialist JC Van Marken, but it’s been a method of cyber-attacks since the 1990s.

In the 1990s, social engineering involved calling users to trick them into divulging their credentials or providing the dial-in landline number that connected a threat actor to an internal corporate server. Now, attackers use social engineering to trick targeted users into sending potentially millions of dollars to offshore bank accounts, costing organisations millions in damages. In some cases, employees lose their jobs after the fallout and damages.

The lines between social engineering and phishing are blurred because they usually go hand-in-hand in a sophisticated attack. Social engineering usually involves masquerading as a legitimate employee (e.g., the CFO or CEO) or tricking an employee into thinking that the attacker is a legitimate customer in an effort to get the employee to provide the attacker with sensitive information or change account features (e.g., SIM swapping).

Regardless of the attacker’s goals, there are some clear signs that communication is from social engineering. One primary component in social engineering is playing on a targeted user’s fears and emotions. The attacker doesn’t want the targeted user digesting and contemplating the request, so social engineering involves using fear and a sense of urgency.

A few common traits in all social engineering attacks are:

The overall technique used in social engineering is using emotions to trick users, but attackers use several standard methods to push the user into performing an action (e.g., sending money to a bank account) and making the attack look more legitimate. Usually, the techniques involve email or text messages, because they can be used without voice conversations.

A few common techniques include:

Businesses are also targets for social engineering, so employees must be aware of the signs and take the necessary steps to stop the attack. It’s the responsibility of the organisation to educate their employees, so follow these steps to empower your employees with the tools to identify an ongoing social engineering attack:

Proofpoint knows that social engineering attacks are highly effective at targeting human emotions and mistakes. We have security awareness training and education programs that help employees identify social engineering and the phishing emails that work alongside these attacks.

We prepare users for the most sophisticated attacks and give them the tools necessary to react. Using real-world examples, employees will be prepared to identify social engineering and react according to the organisation's set security policies.

Cyber-attacks continue to rise, and they are getting weirder. Check out this post for a round up of the strangest social engineering tactics that we saw last year.

Social engineering is a component of nearly every threat actor’s toolbox who uses email as an initial access vector.

In our latest social engineering report, Proofpoint researchers analyse key trends and behaviours in social engineering throughout 2021 that highlight some common misconceptions people may have about how criminal or state actors engage with them.

In this first instalment of our six-part blog series, we’ll be focusing on social engineering as an essential security awareness training topic.