The Psychology of Social Engineering
The power of psychology, people, and persuasion is essential to successful social engineering attacks.
In social engineering, cyber attackers target people rather than systems. While seeking access to sensitive information is a common goal in cybercrime, social engineering tactics are novel and rooted in human behavior.
Attackers victimize individuals with targeted, often personalized, emails, texts, and hyperlinks. People who believe the deception in these custom missives frequently take unsafe, emotionally driven actions: revealing personal information, clicking on dangerous links, or opening unsafe attachments.
According to Verizon's 2024 Data Breach Investigations Report, an estimated 68% of cyber attacks involve a human element, such as an employee falling victim to a social engineering attack. These risks are significantly higher for small and midsized businesses (SMBs). The average SMB employee sees 350% more social engineering attempts than an employee of a larger organization.
How social engineering exploits human psychology
Social engineering attacks exploit human psychology by taking advantage of people's natural behaviors, emotions, and motivations. In a professional setting, these include the willingness to open and respond to personalized emails, accept demands for electronic payments, or search for engaging or sensationalized news online.
An estimated 68% of cyber attacks involve a human element, such as an employee falling victim to a social engineering attack — Verizon, 2024 Data Breach Investigations Report
Attackers tailor their exploits around predictable responses and expected behaviors. For example, when an employee opens an email using their name, that's expected behavior. It appears personal and directed at that individual. Such an email is a classic phishing tactic and social engineering exploit that inspires trust through familiarity.
Attackers want targets to willingly provide sensitive information or access to company systems and assets. Targets often help social engineers because their requests appear legitimate and offer a gift, discount, or exciting news. However, they don't realize they are putting their organizations at risk.
Trust
Trust is one of the most common ways to exploit human psychology in social engineering. Attackers gather employees' personal information on social media or employee forums, learn about work routines and activities, and gain insights into behavioral patterns. Then, they use that information to send customized emails, texts, and specific, sensationalized web links to lure employees in.
Attackers aim to understand human behavior and motivation. They gather an employee's personal information on social media or employee forums, learn about work routines and activities, and gain insights into behavioral patterns. They then customize their tactics, seducing the target and establishing trust within the first few moments of an interaction. Trust is essential for the attack process.
Fear and urgency
Fear and urgency in social engineering also exploit psychology and cause people to fall prey to attacks. Many messages convey a sense of urgency, and urgency accompanied by a threat inspires hasty action, often without due diligence. An example is the threat of not paying a so-called overdue invoice with the warning of account closure. Who hasn't made a less-than-prudent decision when in fear and facing a ticking clock?
Curiosity
Human curiosity plays a role in social engineering exploits. Attackers use enticing information and exciting headlines to tempt targets into clicking malicious links. Once they open the link, targets may provide sensitive information or download malware, following their curiosity and interest in seemingly important information, even if it's misleading or false.
Real-world examples of social engineering
Social engineering attacks come in various forms, ranging from tried-and-true tactics like phishing and impersonation within private inboxes to more novel methods like SEO poisoning that occurs in public search engines. Below are some recent examples we've witnessed at Coalition:
Phishing
Phishing is a type of social engineering in which an attacker tries to trick victims into sharing sensitive information. Attackers sometimes ask users to share account credentials and financial information voluntarily. In others, attackers prompt users to click a link or download an attachment they believe is legitimate.
Construction Company Employee Inboxes Infiltrated Despite MFA An employee at a US-based construction company received a phishing email that contained a malicious link. The employee clicked on the link, which allowed the attacker to bypass the company’s multi-factor authentication (MFA). The attacker then gained account access and sent thousands of internal and external phishing emails to employees and the company's clients. Six other employees received and opened the same phishing email, leading to even more compromised email accounts. Read about this case. |
|---|
Impersonation
Impersonation attacks are another form of social engineering in which attackers pose as family members, trusted colleagues, vendors, or clients to deceive employees into granting access to systems, facilities, or sensitive data.
SaaS Tech Company Narrowly Avoids Social Engineering Scam A US-based technology company implemented a bug bounty program to encourage reporting of software weaknesses and vulnerabilities in its product. A group of seemingly ethical hackers contacted this company and reported multiple security vulnerabilities. Their report established credibility with the security researchers, and the company offered a lump-sum payment for these new “bugs” or findings. The hackers refused the lump-sum payment and attempted to extort the business for more money. Read about this case. |
|---|
SEO poisoning
Search engine optimization (SEO) poisoning is a technique that leverages search engines to trick users into clicking links that appear legitimate but are malicious. Attackers then use this technique to carry out different types of cyber attacks. In these cases, attackers' search engine rankings make harmful webpages rank highly in common searches to deceive users into clicking their links.
Solo Practitioner Law Firm Curbs Social Engineering Scam After a US attorney installed a new surveillance system at his office, he couldn't sync his devices and searched online for tech support. After clicking on a link in his search engine, he unwittingly gave a representative posing as technical support at the surveillance company access to his computer. The fraudulent representative claimed the lawyer's computer was infected with malware and would remove it for a fee. Once the fee was paid, the computer started to simulate a malware infection to extort more money. Read about this case. |
|---|
These examples illustrate the dangers of successful social engineering attacks. The target may be one employee, but the result can impact multiple businesses and systems. The tactics may vary, but the psychology is the same: appealing to humans by establishing trust, inspiring a sense of fear and urgency, and piquing curiosity. When an employee falls prey to these tactics, the rest of the attack follows — and the impact can devastate everyone involved.
Strengthening defenses against social engineering
Be proactive and strengthen your individual and business defenses against social engineering threats. One way is to arm yourself by recognizing and resisting the psychological triggers: trust, fear, urgency, and curiosity.
Trust is human nature, and so is discernment
Understand that trusting and responding to personalized messages is human nature, but should come with increased scrutiny. Consider a few things before responding to an email sent directly to you:
Would a business contact try to manipulate or ask you for money?
Is the message well-written? If not, consider why.
Confirm the email address carefully. If it's a text, check the phone number it's coming from. Do you recognize it?
Be curious. If you're unsure, don't respond. Report it to your IT department if that's an option.
If there is a link in the email, do not immediately click it. Instead, hover over it and look for misspellings or discrepancies in the URL (e.g., go0gle.co vs. google.com).
Watch for red flags and verify legitimacy
Verify legitimacy by cross-checking and confirming the message from other sources, such as the telephone or a service provider's website. Even a seemingly legitimate message that requests sensitive information or login credentials is a red flag.
Your bank, for example, will never ask for personally identifiable information via email or text. If unsure, call the bank directly using its website contact information, not the number in the message. Chances are, you will confirm it's a fraud.
Don't react, act
Develop and use your critical thinking skills. Attackers want to elicit an emotional response, disrupting your ability to think clearly. They address you personally, demand immediate action, warn you that failure to comply will lead to severe consequences, and tempt you with sensationalized headlines and clickbait.
These tactics inhibit rational thinking and encourage hurried actions. Don't react. Validate and confirm. Ask a colleague or call the vendor directly to check on the validity of the message, and check a website you trust to see if the "exciting news" is real before clicking an unknown link.
Take five minutes, and you may determine that the message was a social engineering attack. This can save you and your organization time, money, reputational damage, and more.
Prioritize security awareness training
Awareness is the best defense against social engineering attacks. Regardless of size, every business can benefit from educating its employees about how humans are susceptible to such exploits and the risks of social engineering to individuals.
When employees understand how to identify and report potential social engineering scams, their organizations benefit. By increasing awareness on how to act when encountering attacks like phishing emails, impersonation, or SEO poisoning, they help themselves and their employers by not opening internal systems to attack.
Security-aware employees contribute to a cyber-safe work environment by protecting sensitive company data and email systems, preventing financial fraud and corrupted systems, and disrupting risks to the stability and reputation of the business.
Regardless of size, every business can benefit from educating its employees about how humans are susceptible to such exploits and the risks of social engineering to individuals.
Make a greater investment in employee awareness
Employees can become security-aware through Coalition Security Awareness Training. Our program helps SMBs educate employees about cyber threats, reduce cyber risk, and enable organizations to meet compliance training requirements. Key training benefits include:
Phishing exercises and content
Exercises that reveal the signs of hidden phishing tactics in email scams, fraudulent messages, invoice change requests, gift card requests, and more
Customizable simulations testing employees on their ability to identify and report phishing attacks
General and extensive training
A regularly updated 200+ library of easily deployable training videos in multiple languages
Pre-designed three-level courses based on security awareness with automated campaigns and reminders to encourage training completion, lessening the burden on IT departments
Compliance courses
Courses in cybersecurity training requirements for industry compliance standards, including SOC2, PCI DSS, HIPAA, and more
Coalition Security Awareness Training is available globally inside Coalition Control®, our unified cyber risk management platform. Log in or sign up and start a free trial directly in Control.
To learn more about our program and other solutions from Coalition Security™, please visit our website or schedule a consultation with a member of our team.
