Spot a Social Engineering Attempt

Overview

Social engineering is when an attacker manipulates a person instead of hacking a computer. It works because humans are helpful, busy, and trust authority. This article gives you the patterns to spot and the right way to push back.

Before You Begin

• Know who in your company is allowed to ask for sensitive information (HR, IT, finance). Most other requests should raise an eyebrow.
• Save a few "known-good" phone numbers and emails for your company's IT and finance teams.
• Recognize that social engineering happens by email, phone, text, chat, and in person.

Steps

1. Watch for urgency. "I need this now" is the most common manipulation tactic. Slow down. Real emergencies survive a five-minute pause.
2. Watch for authority claims. A caller says they are from the CEO, the bank, or the IRS. Authority is the second most common tactic.
3. Watch for unusual channels. Your CFO does not text you on WhatsApp about a wire transfer. Your IT team does not email a personal Gmail asking for your password.
4. Verify through a separate channel. If you get an email from a coworker asking for something odd, call them at a number you already had. Do not reply to the suspicious message.
5. Refuse to give credentials, MFA codes, or password reset links over the phone or in chat. Legitimate IT staff will never ask for these.
6. Be careful with name-drops. Attackers research targets on LinkedIn and casually drop a coworker's name to seem legitimate.
7. Trust your gut. If something feels off, it usually is. Walking away from a real request costs you a five-minute apology. Falling for a fake request costs your company.
8. Report the attempt to your security team, even if it failed. They can warn the rest of the company about active campaigns.

Troubleshooting

• If you already shared information: report it today. Same-day reports let your security team reset credentials before the attacker uses them.
• If a "vendor" calls and asks for changes to bank or wire details: stop. Call the vendor back at a number from a prior invoice, not the one provided on the call.
• If a stranger tries to follow you through a badged door: politely ask them to badge in themselves or call security. Tailgating is a classic physical attack.
• If you get a text from "the boss" asking for gift cards: delete it. This scam runs continuously and never gets less ridiculous.

Related Articles

• Recognize a Phishing Email
• Browse the Web Safely at Work
• Handle Sensitive Information at Work
• Report a Suspicious Email

Need More Help?

Submit a ticket at support.bostonmit.com or email support@bostonmit.com.