Social Engineering

Social Engineering Explained

The use of deception to get you to give up personal information

• The social engineer gathers information about their victims.
• The social engineer poses as a legitimate person and builds trust.
• They use that trust to get you to act: click, share a code, send money or give access.
• Then they disappear, or they use what they took to target the next person.

Compromised Link Scam

• A message arrives from a friend’s account, often with a shocked emoji and a link to a “video”.
• The friend’s account has already been hacked, which is why it looks real.
• Clicking takes you to a fake login page that steals your password, and your account then sends the same message to everyone you know.
• Do not click. Contact your friend another way and let them know their account is compromised.

Facebook Messenger Video Call Scam

• You get a Messenger video call from a friend or family member. When you answer, you can’t hear anything, but you can see them mouthing that they can’t hear you either. Then the call ends.
• Right after, they message you to say sorry, their Bluetooth or microphone isn’t working.
• Then they ask for money and swear they will pay it back. You just saw their face, so you believe them and send it.
• The only issue: their account was hacked. It was never them on the call, and the money is gone.

Infected Computer Scam

The fake virus pop-up and the “tech support” call

• A loud, flashing warning says your computer is infected and tells you to call a number immediately.
• The “technician” asks for remote access to your computer, then “finds” problems and charges for fake repairs.
• Once they have access, they can install spyware and go after banking and email accounts.
• Real companies do not put phone numbers in pop-ups. Close the browser, restart the device and never give remote access to a caller.

Cousin Needs Your Facebook Code

• A friend or relative’s account says they are locked out on a new phone and need you to receive a code for them.
• The code is really for your own account or a financial account. Sharing it hands the scammer the keys.
• A one-time code is like a house key. Nobody legitimate will ever ask you to read it back.

Fake Coinbase Code Text

• A text shows up with a one-time code for an account like Coinbase, a cryptocurrency app, even if you never asked for a code or don’t have an account.
• The text includes a phone number to call “if you didn’t request it.” That number goes to the scammer, not the company.
• The panic is the trap. You call to stop it, and a fake support agent asks for your code or password, asks to remote into your device, or tells you to move your money to a “safe” account they control.
• Real verification texts give you the code and tell you not to share it. They do not ask you to call a number.

Amazon Large Purchase Scam

• A text, email or call says a large purchase was made on your account and gives a number to call to cancel it.
• The panic of a big charge is designed to make you act before you think.
• The “support agent” asks you to log in, share a code, install an app or buy gift cards to “reverse” the charge.
• Open the real app or website yourself to check your orders. Never use the link or number in the message.

Family in Trouble

• A caller pretends to be a grandchild, niece or nephew in an emergency, or a lawyer or officer calling for them.
• Scammers now use AI voice cloning from short clips posted on social media.
• They beg you not to tell anyone and ask for cash, wire transfers or gift cards.
• Hang up and call the family member directly. Families can agree on a secret code word for emergencies.

Warrant for Your Arrest Scam

• A caller says they are from the police, the sheriff’s office or the court, and that you, a friend or a family member has a warrant.
• They say payment is needed immediately or you, or they, will be arrested.
• Scammers can fake caller ID, so the call may even look like it comes from a real police department.
• They push you to stay on the line and not tell anyone until the payment is made.

No Filter

Who are we really connecting with?

• Accepting every friend or follow request gives strangers a direct line to you and to everyone on your list.
• Fake accounts often have few posts, recently created profiles and many mutual “friends” who also accepted without checking.
• Once connected, they can see your photos, check-ins and family members.
• Filter your list: if you would not recognize them in person, remove them.

Are You Worth Scamming?

Is micro-scamming lucrative?

• Many people think, “I don’t have much money, nobody would bother scamming me.”
• Scammers do not need one big payday. They send the same message to thousands of people at once.
• Can you get rich only by scamming $500? $500 from 1,000 people is $500,000.
• Your accounts, contacts and identity are worth money too, even if your bank balance is small.

How We Compromise Ourselves

The four most common ways we open the door

• Clicking on compromised links.
• Reusing passwords.
• Reusing compromised security recovery methods.
• Using publicly available security information (your pet’s name, school, birthday, first car).

Trust But Verify

One more step to sift through frauds and scams

• Let’s say a scam fools you and you believe it to be true. Trust, but verify.
• If your bank, a friend or a family member contacts you about an issue that needs your immediate attention, trust that it may be a legitimate request.
• But verify it using a different way than the one the original message came in.