Hacking Your Brain: Top 13 Social Engineering Techniques

Spear phishing is a targeted phishing campaign where the threat actor customizes their scam email to appeal to specific victims. For example, an email may target specific personnel within organisation including those who have critical network access permissions, like those in IT or security, or individuals with access to sensitive data, like those in HR or finance.

Whaling is a type of spear phishing where the attacker focuses on targeting higher-value targets like C-Suite executives. It’s particularly used in business email compromise (BEC) attacks.

Angler phishing is a term used for a scam technique where cyber threat actors masquerade as customer support staff using social media platforms and accounts to trick their victims.

A baiting attack is a scamming scheme where an attacker makes a false promise to lure a victim into a trap that may steal personal and financial information or inflict the system with malware. Here, the threat actor tries pique a victim’s greed or curiosity. Baiting can be operated online (enticing ads, rewards…) or in the physical world. For example, an attacker leaves the bait – typically malware-infected flash drives that look authentic – in conspicuous areas where potential victims are certain to see them.

Pretexting has common features with both whaling and baiting. It consists in creating a scenario where the victim feels compelled to comply under false pretences. First, the attacker starts by establishing trust with their victim by impersonating their co-workers, bosses, the police, the bank, tax officials, or anyone with authority. Then, the perpetrator pretends to need sensitive information from a victim so as to perform a critical task. In doing that, they can confirm the victim’s identity and can impersonate them to proceed with their attack or to make financial transactions to their accounts.

Scareware is the use of false alarms and fictitious threats to lure victims into thinking their system is infected with malware, prompting them to install software that benefits the threat actor – to gain information or to deploy a piece of malware. Scareware can take different forms, from simple spam emails to pop-ups and notifications.

Tailgating is a simple social engineering attack used to gain physical access to access to an unauthorized location. To do so, the criminal follows the victim into the area without being noticed.

Piggybacking is similar to tailgating, but here the victim allows the attacker to ‘piggyback’ off their credentials. For that, the attacker can use human feelings such as empathy or kindness. For instance, the victim would hold a secure door open for someone claiming to be a new employee who has forgotten his access badge.

The quid pro quo technique consists in requesting the exchange of some type of sensitive information in exchange for a service that the attacker offers to the victim. For example, a computer user might receive a phone call from a criminal who, posed as a technology expert, offers free IT assistance or technology improvements in exchange for login credentials.

Dumpster Diving is the act of looking for sensitive information in the trash bins before it has been destroyed.