Social engineering is the act of manipulating people into providing confidential information through deception rather than hacking. Common techniques include phishing, pretexting, baiting, and tailgating. To avoid being victimized, one should carefully inspect email addresses, hyperlinks, the context of messages, and be wary of urgent or threatening language, as these are techniques used by social engineers to trick victims.

1. HOW TO SPOT A SOCIAL ENGINEERING EMAIL

2. Social engineering is essentially the
act of manipulating people into
giving access to confidential
information or areas, rather than
using force or hacking. The
information they seek can be
anything from passwords to bank
details, or even employee records
from businesses.
Some common social engineering
techniques include pretexting,
baiting, tailgating, and - most
prominently – phishing. All of these
tactics differ from each other slightly,
but they all depend on the attacker’s
ability to trick the victim into trusting
them.

3. 1. Check Email Addresses
The display name might look authentic, but
email addresses are much harder to falsify.
With many companies purchasing their own
domain names, attackers often have to alter
the spelling slightly – in our example you can
see that the domain reads ‘debemhams’,
replacing the usual N with an M.

4. 2. Hyperlinks
If an email from an unknown source
includes lots of pushy links or buttons
be wary; they can often harbour
malicious software that can log your
keystrokes or take you to a convincing
website where they can steal your
login details.
Avoiding links altogether is the best
practice, but if it seems to be for an
important page try using a trusted
search engine to find it instead, or
hover over the link before clicking to
reveal the URL.

5. 3. The Context
Different social
engineering tactics use
different methods to try
to persuade the user into
complying.
In this instance, the
message offers a reward
in exchange for following
the link, which is an
example of a baiting
email.

6. In this example a service is
offered in exchange for
information instead.
This is a trait of a quid pro
quo attack.

7. 4. Urgent Language
Another sub-category of social
engineering is phishing. These
attacks use scare-tactics to
rush the target into clicking the
link before having time to
properly inspect the message.

8. For more topics and training material visit the Boxphish website.