With summer around the corner, it's good timing to refresh ourselves on the tactics used by social engineers. Social engineering is the attempt to obtain information or access to things (areas, objects, buildings, etc.) using psychological tactics. These tactics vary from inconspicuous to threatening, depending on the situation. It isn’t exclusive to digital mail and can be presented in real life as well.

Technology Services thanks you for taking the time to familiarize yourself with helpful practices and advice designed to protect you and the University from divulging sensitive information. Keeping yourself informed is one way to avoid being a victim.

Phishing
Phishing involves sending malicious or fake emails to large numbers of people or specific individuals in hopes of obtaining private information such as passwords or card numbers. This can be done via text messaging (referred to as smishing). For example, a text message is sent informing you that a large sum of money has been deposited into your bank account. This could also take the form of an email appearing to be from a legitimate bank.

Hovering over the links provided will reveal the sender’s email address and is a great way to check if they are legitimate or not. When in doubt, take the proper steps to contact the organization.

Pretexting
Pretexting involves a phone call from someone who claims to be part of an organization with the intention of placing you in a position to divulge private information. When in doubt, contact the official organization or look on their website for a frequently-asked questions (FAQ) page concerning these calls.

Baiting
Baiting is designed to tempt a victim into taking the bait, thus the name. The tempting content could be the promise of a gift or the possibility of a reward. The hacker's job is to create a trap for its victim with the end goal of infiltrating a company or private network.

Although not widely used, another possibility is the strategic placement of tainted devices for targeted employees to take. Marked with intriguing labels like "confidential” or “salary info” the device may be too tempting to pass up. Someone may take the bait and insert the infected device into their company or personal computer — providing access to a business or private network.

Scareware
Similar to ransomware, scareware intends to alarm users into a state of panic to get people to do things they would not normally do. For example, a pop-up from a site in large letters stating, “You have a Virus!” is more frightening over a red background. The pop-up may then be used to extract information such as financial information (credit card/bank account numbers). Stick with verified sites that typically do not host these kinds of ads.