Social Engineering

Phishing messages are fake emails or texts that pretend to come from an organisation you trust. They rely on you acting before you think, so they carry warning signs you can learn to spot.

Warning signs

• Generic greeting — a company that really holds your account knows your name, so a message that greets nobody by name has been sent to thousands of people at once.
• Urgency or threats — such as “pay the 99p owed within 12 hours or your tickets go back on sale”. The rush is deliberate: it stops you looking closely at anything else.
• A sender address or link that does not match the organisation — the display name can look right while the real address does not, such as support@gamehub-billing.net instead of the company's own domain. Read a link's address before you click it.
• Spelling and grammar mistakes — real organisations check their messages carefully before sending them, though a neat message can still be fake, so weigh up every sign together.
• Requests for passwords or bank details — a genuine organisation will not ask you to send these in a message, so that request alone is a warning sign.

Taking a message apart

A text arrives saying you have been picked for a £100 voucher: “Claim it within 15 minutes through the link below by entering your username and password.” Nobody is named, there is a deadline, a link and a request for login details — four signs in three lines.

What to do instead

Do not follow links or open attachments in a message you were not expecting. Instead, contact the organisation using official contact details you found independently — the address on its own website, or the number on your account paperwork — and ask whether the message is real.

Following a link can be harmful even if you download nothing: it may open a fake copy of a login page, and whatever you type into it goes straight to the attacker.

The purpose of a social engineering attack is what the attacker is trying to achieve — the reason for deceiving a person in the first place. The trick is only the method; the purpose is the prize behind it. Most attacks are aimed at one of a small number of gains:

• Login details, so the attacker can sign in as someone else.
• Money, through bank details, card numbers, or a payment the victim is talked into making.
• Personal data such as names, addresses and dates of birth, which can be sold on or used for fraud.
• A route past the organisation's defences for malware, by getting a user to open an attachment or install a file that its filters would otherwise have blocked.
• Access to a network or a building, such as a password, a door code or a door held open for a stranger.

How, purpose and threat

When you describe a social engineering attack in a scenario, give three parts. How the attack was used — the method and what the victim was persuaded to do. The purpose — what the attacker gained or was trying to gain. The threat it posed — the harm that could follow for the devices, systems or organisation. Stopping at “they sent a fake message” describes the method but says nothing about why it was sent.

For example, a message posted in a school class chat, apparently from a teacher, asks students to sign in through a link to confirm next year's subject choices. How: students are rushed into typing their school username and password into a page that only looks like the school login. Purpose: the attacker collects dozens of working logins. Threat: every one of those accounts can then be opened, so coursework, email and saved files could be read, changed or deleted, and more messages could be sent from an account people already trust.