Social Engineering Attacks: A Small Business Guide

1

Videos

20 Min.

Read Time

Cybersecurity

Topic

2

Free Downloads

Share This Page:

Social engineering attacks account for up to 98 percent of cyberattacks – making them a massive risk for your small- to medium-sized business. So, what do they look like and how do you protect your small business from them? Discover everything you need to know in this guide.

What is Social Engineering in Cyber Security?

The social engineering definition is pretty straightforward. In these attacks, hackers try to manipulate you into doing something that goes against your best interests. How?

Well, they use tactics that go beyond the traditional hacking techniques you might imagine. However, you’re probably familiar with at least one example. Because the most common method used in social engineering attacks is phishing.

Why is Social Engineering Effective?

Social engineering works so well because it relies more on human psychology and deception. Cybercriminals make you feel strong emotions – like greed, fear, and curiosity. By exploiting your fundamental behaviors and emotions, they can get what they want more easily than attempting to break through tough technological defenses.

Secure your company’s email with DMARC, DKIM, and SPF protocols. Most attacks originate in email. And the email solutions we recommend come “baked in” with high-quality SPAM protection.

If your email solution does not, deploy a best-in-class solution designed to reduce spam and your exposure to attacks on your company via email.

Example of Social Engineering Using Fear

Firewalls are fundamental for protecting a company’s data, computers, and networks. They are required for compliance with mandates like PCI DSS, HIPAA, and GDPR. This is a must-have for all businesses.

Turn on Intrusion Detection and Intrusion Prevention features. Send the log files to a managed SIEM. If your IT team doesn’t know what these things are or you don’t have an IT team, we urge you to look at hiring an MSP to assist you.

Here’s an example: Someone receives a phishing email telling them that there’s a problem with their bank account or an unpaid invoice. Because money issues elicit strong emotions of fear, they trick them into clicking on a link that appears legitimate.

Unfortunately for them, that link contains malicious code – such as ransomware, that prevents them from accessing their data.

What is Phishing?

Phishing is the most common social engineering method. In fact, CISA reports that 90% of cyberattacks gained access to a company through a phishing attack. Hackers use this tactic because they can easily deploy it and quickly target many people with little effort.

Phishing involves sending fraudulent communications – typically emails – that appear to come from a reputable source. Generally, they try to convince you to give up sensitive information so they can use it to:

Access your online accounts.
Obtain personal data.
Compromise computer and mobile systems.

Strengthen your organization’s defenses against advanced cyberattacks, like ransomware, by elevating phishing awareness with these expert tips and actionable insights.

Additionally, like in our previous example, attackers may use phishing attacks to install malware on your machine. This installation can serve a variety of purposes. Hackers may use it to steal more information (like banking details or personal data) or to gain remote control over your device.

Understanding phishing and other social engineering attacks is a crucial part of your organization’s cybersecurity plan.

What’s the Difference Between Spam and Phishing?

Spam mail, also known as junk mail, is often unsolicited commercial advertising. These emails are sent out in bulk to a wholesale recipient list. However, spam can sometimes be a social engineered spoofing attack where the hacker hopes to gain access to your computer.

This type of malicious spam can be sent by botnets. Botnets are a network of infected computers that allows an attacker to control the devices remotely without the owners’ knowledge.

In essence, spam may contain phishing (like in a spoofing attack where someone disguises their identity to look like a trusted source). However, the spam you encounter in your email may simply be a harmless – albeit sometimes annoying – ad.

It’s important to know how to safeguard yourself. Learn how to protect yourself from phishing, and other social engineering attacks in the section below called, An Expert Look at Social Engineering Prevention.

Early Days of Social Engineering

Social engineering, specifically phishing, began around 1995. Phishers began their attacks during the popular days of America Online (AOL). They did this by stealing users’ passwords and employing algorithms designed to create randomized credit card numbers. However, this strategy wouldn’t last forever because AOL caught on.

And when they did, they created security measures to prevent these social engineering tactics from being used. Of course, these early cybercriminals simply moved on to create new techniques.

To what, you ask? Well, they started using a tactic you’ll often see in today’s phishing attacks. They began impersonating AOL employees to fool their victims into giving them their account and billing information. They did this using email and AOL Instant Messenger (AIM) to target their victims.

In 2001, hackers trying to steal information became more interested in online payment systems. They began using manipulative methods to make their victims feel safe, even though they weren’t. This often looked like creating HTTPS sites. On these sites, the cybercriminal would try to convince their targets to give up their credentials and personal information.

These days, social engineering attacks – like phishing – are even more frequent and elaborate.

4 Reasons Why Social Engineering Attacks are Becoming More Frequent

Social engineering attacks can have a devastating impact on both individuals and businesses. Companies that fall prey to these attacks often suffer:

Significant financial losses
Downtime
Damage to their reputation
Loss of stakeholder trust
And more

Unfortunately, the increased frequency and sophistication of these threats pose a significant threat to the stability of your organization. Here are a few reasons why they are becoming more widespread.

1. Insufficient Security Budgeting

Organizations are reducing their cybersecurity budget or not investing enough. This leaves them vulnerable to the growing threat landscape.

Additionally, many are not investing in effective security awareness training and simulated phishing attacks. This creates more opportunities for hackers to exploit the weakest link in their cybersecurity defenses.

2. Constantly Evolving Tactics

It’s important to understand that hackers are constantly evolving and adapting their tactics to exploit business vulnerabilities. Because their strategies are continually changing, so should yours. Your organization must be prepared to defend against a moving target.

Example

Over the last few years, threat actors have been using website contact forms to target businesses. These hackers pose as legal authorities and claim that your company is not complying with the law. Then, they that you download a “report” which is a malicious threat.

So, it’s vital to stay current on new types of scams and tactics to keep your business safe.

3. Readily Accessible & Cheap Tools

Hackers can easily obtain inexpensive phishing tools through the Dark Web. This accessibility allows anyone with little to no technical knowledge to become a hacker. But there are other tools hackers use to manipulate you.

Just like you or me, cybercriminals can boost their operations by taking advantage of generative AI, like ChatGPT. What does this tool have to do with social engineering?

Well, they can use it to streamline their operations and improve outcomes. Generative AI allows them to maliciously create tailored social engineering attacks.

Over the last decade, business email compromise (BEC) has caused over $50 billion in losses. That was before the advent of accessible AI. Imagine the damages that could come from becoming a victim of a BEC attack now…all because the messaging was so convincing. 

4. Remote/Hybrid Workforce

Remote and hybrid work models adopted since the pandemic have introduced new cybersecurity challenges. They have dispersed workforces and expanded the use of mobile endpoints. Many organizations were, or still are, unprepared to protect employees outside of the traditional company network. Consequently, this has led to an increase in phishing attacks.

There are many reasons why attacks are growing more frequent. As technology and our businesses change, so do cybercriminals. Let’s dig into 14 social engineering attack examples your small business faces today.

14 Types of Social Engineering Attacks

Explore 14 social engineering examples employees in your business are likely to encounter.

1. Spear Phishing

Imagine physically going spear fishing. What would it take to catch a big fish? It would take precision, patience, and practice. It’s the same for spear phishing attacks.

In spear phishing, attackers target specific individuals or organizations. Attackers spend more time researching and crafting their plans in spear phishing than traditional methods. Why?

Because these targets often require them to be more convincing. So, they tailor their messages based on characteristics, job positions, and contacts of their victims to make their attacks more likely to be successful.

Attackers might spend days or weeks creating emails that are so well-crafted that they appear to be from a known and trustworthy source.

2. Business Email Compromise (BEC)

Business Email Compromise (often called BEC) is a more sophisticated type of phishing attack where an attacker impersonates a high-level executive (like a CEO) or a trusted vendor. The attacker attempts to trick a staff member, often in the finance department, into transferring money.

Discover the proper setup, strategies, and tools you need to take control of your email security to prevent business email compromise.

BEC attacks don’t necessarily involve sending malware but focus on manipulating the target into making wire transfers.

3. Whale Phishing

You might be asking yourself, “Whaling? Whale phishing? What is that?”

As its name might suggest, whaling is a type of social engineering that targets a specific group of people. It’s a form of spear phishing that is directed at very high-level targets like C-level executives, politicians, or celebrities.

Whaling attacks are highly personalized. Often, cybercriminals have deep knowledge of the victim in order to:

Access sensitive personal or business information.
Initiate large financial transfers.
Gain high-level administrative access.

These targets have the potential to yield giant results when successfully executed. So, criminals plan these attacks well in advance – coordinating them with other attack methods to ensure the greatest success rate.

4. Smishing (SMS Phishing)

Smishing attacks are a cybercriminals way of trying to gather your confidential information through a channel other than email. In this case, they conduct their assault through a text messge.

A popular example of this is a hacker sending you an SMS message pretending to be a bank. The message will claim that a security issue requires your immediate attention. They’ll attach a link that directs you to your bank’s login page.

While the page may appear legitimate, it’s a fake page that records your keystrokes. If you enter your login information, the attackers can use it to gain unauthorized access to your bank account.

5. Vishing (Voice Phishing)

Cybercriminals have gotten more creative – looking to attack people where they spend a lot of time. Vishing, specifically, occurs when attackers try to gather valuable sensitive information in a phone call.

This social engineering technique can be quite convincing. Especially if they use the names of large known organizations the victims have worked with and pair this knowledge with urgency and fear tactics.

6. Artificial Intelligence (AI) Phishbait

As we know, the use of AI is on the rise. Many people are incorporating AI chatbots (like ChatGPT and Google Bard) into their daily routines. Unfortunately, hackers are exploiting this trend and using it as an opportunity to steal your data.

One example is a scheme where attackers develop bogus social media ads offering free downloads of AI products. When you click on the ad, it instructs you to download a fake file. What’s the file, you ask?

It’s malware. It infects your device and is used to access sensitive data, such as:

Login credentials
Social security number
Credit card numbers

7. QR Code Phishing

Did you know that cybercriminals are also using QR codes in their messaging to hide their malicious intent? Most people don’t – which makes it even more dangerous.

When a code is scanned, you’re either directed to a site containing malware or prompted to input sensitive information. This method, also known as quishing, is growing in popularity.

8. Clone Phishing

Many organizations rely on email to communicate important information to their customers. Occasionally, they’ll send an email that’s missing content. Which leads them to send a follow up email containing the missing details. In a clone phishing scam, cybercriminals imitate this type of email accident to manipulate you.

How Clone Phishing is Executed

Attackers gain access to a legitimate business email.
Then, they clone an already sent email.
They send a follow up email claiming that the original one was missing an attachment with urgent information.
This appearance of legitimacy encourages recipients to download the attachment.

However, this attachment contains malware that allows the hackers to steal sensitive information once downloaded. That’s why it’s important to be cautious and avoid downloading attachments from emails. Even if they appear to be follow-up messages from legitimate organizations.

9. Angler Phishing

Angler phishing uses social media to attack victims. Hackers start by creating fake customer service accounts on platforms like Facebook and Twitter.

Attackers generally wait for social media users to come to them – which makes this is a slow-moving attack. When the victims engage with these fake accounts, they are unknowingly coerced into giving away their sensitive information to a hacker.

10. Barrel Phishing

Barrel phishing, also known as double-barrel phishing, is growing in popularity. In a barrel attack, phishers use two separate phishing emails to gain your trust.

The first email often lures you into a false sense of security. They do this by having a normal conversation in an email that appears to be from a trusted source. This email may not have any malicious intent beyond the deception itself.

The email that follows, though, is often an aggressive email. It often contains persuasive messaging and malicious content (like links) to make you do what they ask. By getting an emotional response from you, they convince you to do things you might not otherwise do.

11. Pretexting

Pretexting is a form of social engineering used by attackers to either obtain sensitive information from you or get you to take an action under false pretenses. The attacker typically pretends to be someone trustworthy – such as a coworker, IT technician, or bank representative. This method involves a high level of deception and often relies on the attacker’s ability to appear legitimate.

12. Watering Hole Attack

A watering hole attack is a cyber attack that incorporates technical methods and social engineering to compromise systems. It starts by targeting a specific group of users and finding the websites they commonly visit. The attacker then attempts to find vulnerabilities in one or more of websites and injects malicious code into them.

When the targeted individuals visit these now infected websites, the malicious code can exploit vulnerabilities on their devices to install malware without their knowledge. These attacks are effective because they use the trust users have in known sites.

13. Baiting

Baiting is a form of social engineering that involves offering something enticing to the target as a lure. The bait can take many forms, such as:

A free download.
A USB drive left in a visible location.
An email promising an attractive offer.

The common factor is that the bait promises the victim a benefit that motivates them to act.

14. Tailgating

Tailgating is the act of following someone closely into a secured area without authorization. This usually happens at entrances that need electronic access control in offices, apartment complexes, or other secured buildings.

The person tailgating takes advantage when an authorized person opens the door. They then follow this person inside – who either holds the door open or doesn’t realize that someone is behind them.

This technique exploits politeness. Because people often hold doors for others out of courtesy, without questioning their right to enter.

How to Identify a Phishing Email

Phishing is one of the most common social engineering vectors – making it important to know how to identify them. Look for these red flags:

Emails containing grammatical errors or poor language.
Emails from someone you don’t know.
Unexpected emails trying to get you to send money to a strange account.
Emails asking you to change your password or login information.
New email messages pop up that you never sent or messages you didn’t receive.
Unexpected emails asking you to click on a link that leads to a website you don’t own.

Remember, if an email is trying to evoke emotion or an action, ask yourself why.

To verify if it’s a real request and not social engineering, contact the person or organization directly using a phone number you know is legitimate. Not one provided in the suspicious email.

Social Engineering Cybersecurity Best Practices

Hackers target small to medium-sized businesses (SMBs) because they have less expertise, smaller budgets, and less time to defend themselves. Safeguard against social engineering using these best practices:

Never share personal information.
Utilize firewalls and antivirus software.
Use multi-factor authentication (MFA).
Enforce mandatory password managers. There are great ones available and even some free ones – like LastPass.
Be proactive and stay informed on the latest phishing techniques. This means regular training for all employees – from intern to CEO.
Don’t click on links from unexpected emails or instant messages. Hover over any links you’re unsure of to view the address to verify the site is legitimate before clicking. When in doubt, don’t click. Contact your cybersecurity expert for guidance.
Keep your browser updated to ensure security patches are installed.
Install an anti-phishing toolbar. The toolbar will check sites you are visiting against known phishing sites and alert you if you are heading toward a malicious site.

Keep your systems current on security patches and updates.

The Importance of Email Filters

Take advantage of email phishing filters – like Office 365 anti-phishing protection. Just keep in mind that even though phishing filters exist, they can’t stop all the attacks from getting into your inbox. Every person in an organization needs to have attention to detail when engaging with any email.

Discover the proper setup, strategies, and tools you need to take control of your email security to prevent business email compromise.

Endpoint Detection and Response

Another great way to stay protected is by utilizing Endpoint Detection and Response (EDR) – also known as Endpoint Detection and Threat Response (EDTR). This cybersecurity solution offers crucial visibility and control over endpoints.

Remote Work Security

Do you have remote workers? Because they are removed from your organization, they are more at risk for a malicious attack. Make sure they are also receiving cybersecurity awareness training, antivirus protection, and MFA.

Also ensure that every remote worker’s system stays current with the latest updates and patches. For added protection, employ VPN, or virtual private network. This will encrypt website traffic since they are not working behind your company firewall on a secure network.

What to Do After a Social Engineering Attack

If you or your organization are targeted by social engineering, there are steps you can take to protect yourself. Follow these six steps to mitigate the damage.

Change the passwords on all email accounts.
If someone sent money, contact your financial institution. Request a recall or reversal as well as a Hold Harmless Letter or Letter of Indemnity.
Scan your computers for malware. If present, isolate it to prevent spreading.
Keep stakeholders informed about the breach.
Consider placing a fraud alert on your credit reports to help prevent the cybercriminals from opening new accounts in your business’ name.
Report any business email compromise (BEC) with the FBI to help prevent others from getting scammed.

The most effective way to keep your business protected from the risks of social engineering is…to be proactive. These are the cybersecurity measures experts at Teal recommend.

Security Awareness Training

Security awareness training is a vital tool for protecting your small business from social engineering attacks. By educating employees about the tactics attackers use and how to respond to them, you can significantly enhance your overall security posture.

Employees need to:

Understand the risks of social engineering.
Know what phishing is.
Be able to identify attacks.
Know how to report attacks.
Know what actions to take after an attack.

Simulated Phishing Campaigns

Simulated phishing campaigns are fake phishing attacks sent to your staff and designed to improve their response to real-life attacks. Testing is a crucial aspect of your organization’s cyber resilience.

Enabling MFA on Your Accounts

Multi-factor authentication helps keep your organization safe. It does this by adding at least one more factor beyond passwords to allow access to systems and/or applications.

That means, even if a hacker has your password, they won’t be able to access your account. Because they can’t authenticate without access to your other factors.

MFA can protect against:

Phishing
Spear phishing
Keyloggers
Credential stuffing
Brute force and reverse brute force attacks
Machine-in-the-middle (MITM) attacks
And more

Email Identifier Tags

Implementing the use of email tags (like the [External] tag) will give you insight into a messages source. Seeing this tag does not mean it is a scam. But it helps you know if it is from a known sender.

IP Address Allowlist

An allowlist is a security list created by your IT team or your MSP to give you access to pre-approved programs, IPs, or email addresses. That means that anything not on the list does not get access to system resources.

IP Address Allowlist Example

Phishing often involves deceiving individuals into revealing sensitive information, such as login credentials. If you have an IP allowlist setup, it ensures that even if this information is compromised, unauthorized users cannot access your system unless their access attempt comes from a trusted IP address.

Implementing Conditional Access Controls

Conditional access controls are a set of policies and protocols that adjust the level of access granted to users based on specific conditions being met. According to Microsoft, conditional access is particularly effective in securing regulated content.

Access Control Example

You might implement conditional access policies in your organization to ensure that, before a user can access Microsoft 365, their device is equipped with the latest antivirus software and all necessary patches. This setup is particularly valuable in maintaining high security standards.

So, even if a user’s credentials are compromised through a social engineering attack, additional safeguards like these can prevent unauthorized access.

Identify Suspicious File Names

As we’ve discussed, threat actors often try to lure their victims into downloading malicious files from emails. Hackers can hide the true intention of the file with long names or hidden file extensions.

Always be wary of any unexpected attachments. Hackers often hide the .EXE part of the name from view. So they can make executable files (.exe) look like a harmless .JPG or .PDF. Click on it and a malicious program starts running – potentially exposing your organization’s data to the hacker.

Real-life Example

If you click on a suspicious file, your cybersecurity team should receive an email that details the security issue so they can take proper action.

Here’s an example of what that message might look like:

Knowledge is Key to Prevention

Not preparing for the inevitable can lead to devastating effects. That’s why cybersecurity is a wise investment. Because it prevents costly data breaches. So, don’t let the cost of mitigating risks prevent your organization from staying secure. Be proactive and develop a sound cybersecurity plan to protect your small business.