In Focus – SCCCU Blog

Social engineering is a form of manipulation that exploits human psychology to gain access to confidential information, often for malicious purposes. Protecting yourself from social engineering attacks is crucial in the digital age, where personal and financial information is highly valuable. Here’s how you can safeguard yourself.

Understanding Social Engineering

Social engineering attacks come in various forms. Recognizing these tactics is your first step to protection:

• Phishing involves tricking individuals into providing sensitive information by pretending to be a trustworthy business or entity. For example, an email appears to be from your financial institution asking you to verify your account details. The email includes a link to a fake website designed to steal your credentials.
• Vishing (Voice Phishing) is basically phishing using a phone instead of email. For example, an attacker calls, pretending to be from your financial institution's fraud department, claiming suspicious activity on your account. You are asked to verify your account details. Trusting the caller, you provide the sensitive information, which the attacker then exploits.
• Smishing (SMS or Text Phishing) is phishing using text messages. For instance, you receive a text message from your mobile carrier telling you your service will be interrupted if you don't click on a link immediately to update your information or make a payment. Unfortuantely, this link leads to a malicious website.
• Pretexting involves creating a fabricated scenario to steal information. For instance, an attacker might call an employee, posing as an IT technician conducting a routine security check. The attacker claims there's an issue with the employee’s account and requests their login credentials to resolve it quickly. The attacker uses technical jargon and a sense of urgency to appear credible.
• Baiting offers something enticing to lure victims into a trap. For example, an attacker leaves a USB drive labeled "Confidential" in a public area. A curious individual finds it and plugs it into their computer, unknowingly installing malware that grants the attacker access to their system.
• Tailgating involves following someone into a restricted area without authorization. For example, an attacker waits near a secure office entrance, and when an employee uses his or her keycard to enter, the attacker slips in, pretending to be in a hurry or carrying heavy items, thus bypassing security measures.

Recognize the Signs

Social engineers often manipulate their targets through urgency, fear, or curiosity. Don't respond immediately if you receive an unexpected email or phone call asking for personal information. Verify the requester's identity through a separate, trusted channel before providing any information. Be skeptical of unsolicited messages, especially those that ask for sensitive data like passwords, social security numbers, or banking details. IMPORTANT: SCCCU will never email or text you to update your financial information, and we will not ask you to provide that information via any type of insecure channel. 

Strengthen Digital Hygiene

You should take the same care with your digital hygiene as you do your personal hygiene. Here are some ideas to consider to keep your information safe:

1. Use Strong, Unique Passwords. A strong password combines upper- and lowercase letters, numbers, and symbols. Avoid using easily guessable information like birthdays or common words. You may consider using a password manager to generate and securely store your passwords from different accounts.
2. Enable Two-Factor Authentication (2FA). 2FA adds an extra layer of security by requiring a second form of verification, such as a text message code or authentication app, in addition to your password.
3. Keep Software Updated. Regular updates patch security vulnerabilities. Ensure your operating system, browser, and other software are up-to-date on your computer and any mobile device you use.
4. Be Cautious with Public Wi-Fi. These networks are often unsecured, making it easier for attackers to intercept your data. Avoid accessing sensitive information or conducting financial transactions on public Wi-Fi, and consider using a Virtual Private Network (VPN) for a more secure connection.
5. Limit Sharing. Be mindful of the information you share online. Social engineers can use data from social media profiles to craft convincing attacks. Adjust your privacy settings to restrict access to your personal information.
6. Verify Requests. Before sharing personal or financial information, verify the requester's identity. Contact the organization directly using official contact information from their website, not the contact details provided in the message.
7. Shred Sensitive Documents. Physical documents containing personal information should be shredded before disposal to prevent dumpster diving.

Trust Your Instincts

If something feels off, trust your instincts. Social engineers often rely on creating a sense of urgency to bypass your better judgment. Take your time to assess the situation, and don’t be pressured into making hasty decisions. It's better to be overly cautious than to fall victim to an attack.

Responding to an Attack

If you believe you have fallen victim to a social engineering attack, take immediate action:

1. Change Passwords. It is critical to change the passwords for the compromised accounts and any accounts using the same login credentials.
2. Notify Relevant Parties. Inform your financial institution, credit card company, or any other relevant entities about the breach. They can help monitor for fraudulent activity.
3. Report the Incident. Report phishing emails or messages to the appropriate authorities, such as the Anti-Phishing Working Group (APWG) or the Federal Trade Commission (FTC).

Protecting yourself from social engineering requires vigilance, awareness, and proactive measures. By understanding the tactics used by social engineers and implementing strong security practices, you can significantly reduce the risk of falling victim to these attacks. Stay informed, educate others, and always verify requests for sensitive information to safeguard your personal and financial data.