14 Oct 17 Social Engineering Red Flags to Watch Out For
Social engineering attacks are on the rise, and it’s important to be aware of the warning signs that one is happening. Many businesses have fallen victim to these attacks due to their effective nature, which can result in loss of data, intellectual property, and even customer trust.
In this blog post, we will share 20 social engineering red flags. This will cover warning signs that occur via email, over the phone, and even in person.
What are Phishing Red Flags?
Social engineering comes in many forms, but phishing emails are some of the most prevalent. Phishers can send out thousands of emails per second, as opposed to the in-person social engineering attacks. Even if the attack has a low success rate, it may still be successful with dozens or even hundreds of victims.
Common Phishing Warning Signs
1) Sender Email
An unfamiliar or suspicious sender email address is one of the biggest phishing red flags. This can be an email address that doesn’t match the sender’s name, or one that uses unusual spelling or characters.
2) Spelling and Grammatical Errors
Phishing emails often contain spelling and grammatical errors, as they are mass-produced and may not have been proofread. These mistakes can also occur in the sender’s name and email address.
3) Sense of Urgency or Threat
Phishing attacks often try to create a sense of urgency or threat in their emails, such as saying that your account will be shut down if you don’t take immediate action. This is a tactic to get you to act quickly without thinking about the potential consequences.
4) Unsolicited Attachments or Links
Be cautious of unsolicited attachments or links, as they could potentially contain malware. Only open attachments from trusted senders, and always check that the link is secure before clicking on it.
5) Request for Personal Information
Legitimate companies will not ask for personal information, such as passwords or credit card numbers, via email or over the phone. Be wary of any requests for this type of information and verify with the company directly before sharing it.
6) Request for Payments
Similarly, legitimate companies will not ask for payments via email or over the phone. Verify with the company directly before making any transfers or payments.
7) Mismatched Email Address and Links
Check that the sender’s email address matches the links in the email. Hover over any links to see where they will actually take you, as they may be disguised to seem legitimate but could lead to a phishing website.
8) Generic Greeting
Phishing emails often use generic greetings like “Dear Customer”, rather than addressing you by name. This can be a sign that the email was sent out to a large number of recipients.
9) Unfamiliar Branding
Be cautious of any unfamiliar brand elements or logos in the email, as it could potentially be a fake company trying to mimic a legitimate one.
10) Surveys or Prizes
Beware of any emails offering surveys or prizes, as they could be phishing attempts to gather personal information. Verify with the company directly that promotion is legitimate to be safe.
What are Over-the-Phone Red Flags?
Social engineering attacks can also occur over the phone, often in the form of “vishing” or voice phishing. These warning signs may not be as obvious as phishing emails, but they can still result in a successful attack.
Common Over-the-Phone Warning Signs
11) Caller ID Spoofing
Caller ID spoofing is when a scammer disguises their phone number to make it seem like they are calling from a legitimate company or organization.
12) No callback number
If the caller cannot provide a callback number or refuses to transfer you to a supervisor, this could be a sign that they are not who they claim.
13) Robotic introductions or language
Scammers may use scripted language and technology to automate their calls, leading to a robotic or suspicious introduction.
What Are In-Person Red Flags?
While phishing and over-the-phone tactics are more common, social engineering attacks can also occur in person. These are often seen in tailgating attacks or impersonating a legitimate employee to gain physical access to restricted areas.
Common In-Person Warning Signs
14) Unfamiliar or no company identification
Legitimate employees will typically have company identification, such as a badge with their name and photo. Be cautious of anyone without this type of identification or with an unfamiliar one.
15) Asking for access or assistance
Be wary of anyone asking for physical access to restricted areas or requesting assistance with technology, as they could potentially be trying to steal information or plant malware on devices.
16) Shoulder Surfers
Shoulder surfing is when someone physically looks over your shoulder to try and gather information, such as passwords or credit card numbers. Be cautious of anyone standing too close when entering sensitive information and shield your screen from view.
17) Name dropping
Someone that mentions a legitimate employee or company in an attempt to gain trust could potentially be trying to manipulate you. Excessive name dropping or mentioning high ranking individuals within the company can be a warning sign to verify their identity and reason for access.
Look Out for Red Flags to Avoid Social Engineering Attacks
Social engineering is a term for taking advantage of someone by manipulating their psychological triggers. The trick is to get the person to do or say what you want without them realizing it. The best defense against social engineering attacks is simply being more aware and suspicious of unexpected requests, no matter how innocent they may seem.
Attacks that are dependent on social engineering almost always rely on the victim not being vigilant enough to see through the facade. Use your intuition. More times than not, if something seems off or too good to be true, it probably is. Trust your gut and double check with a legitimate source before taking any action or giving out personal information.