Spotting and Preventing Social Engineering Attacks

Defending against social engineering requires you to practice self-awareness. Always slow down and think before doing anything or responding. Attackers expect you to take action before considering the risks, which means you should do the opposite. To help you, here are some questions to ask yourself if you suspect an attack:

Am I experiencing heightened emotions? When you find yourself particularly curious, fearful, or excited, your ability to assess the consequences of your actions may be compromised. In such instances, you’re less likely to scrutinize the legitimacy of the situation presented to you. It’s important to recognize this as a warning sign if your emotional state is elevated.

• Is the message from a legitimate sender? Have a close look at email addresses and social media profiles when you receive a suspicious message. Look out for subtle alterations in characters that may mimic legitimate addresses, such as “torn@example.com” instead of “tom@example.com.” Also, be cautious of fake social media profiles that replicate your friend’s picture and other details.

• Did my friend actually send this message? It’s prudent to verify with the sender whether they indeed sent the message in question. Whether it’s a colleague or someone else in your network, consider reaching out to them in person or via phone call if feasible. They might be unaware of being hacked or impersonated.

• Are there unusual details on the website I’m visiting? Anomalies in the URL, low image quality, outdated or incorrect company logos, and typographical errors on web pages can raise suspicion of a fraudulent website. If you encounter such discrepancies, it’s advisable to exit the site promptly.
• 
  

• Does the offer seem too good to be true? Be cautious of offers, especially those promising something valuable for little to no gain on the giver’s end. Question the motives behind such offers, as even seemingly innocuous requests can lead to the harvesting and sale of your data to dubious advertisers.
• 
  
• Are attachments or links suspicious? If a link or file name appears ambiguous or out of place in a message, reconsider the authenticity of the entire communication. Additionally, assess if the message was sent in an unusual context, or timing, or contains any other red flags.
• 
  
• Can the person prove their identity? If you’re unable to verify the identity of someone claiming to be affiliated with an organization, exercise caution and refrain from granting them the access they’re requesting. This principle applies both in-person and online, as overlooking the attacker’s identity can lead to physical breaches.