How hackers trick accountants and make a killing

In recent years, the term BEC (Business Email Compromise) has become a persistent symbol of corporate losses and headaches for security services worldwide. Email is a seemingly familiar tool, and many have written about its threats. But BEC attacks incorporate the full arsenal of social engineering, spoofed communications, and even elements of psychological pressure on company employees, most often accountants, financial managers, and executives.

What is a social engineering attack?

Learn about social engineering attack methods and effective prevention strategies to protect yourself and your organization from cyber threats.

In today's digital age, cyber threats are becoming increasingly sophisticated, but social engineering remains one of the most insidious and effective attacks.

Recent statistics highlight the prevalence and impact of social engineering attacks. According to the 2023 Verizon Data Breach Investigations Report, social engineering was involved in 34% of data breaches, indicating its significant role in cybercrime. Phishing attacks alone account for 61% of all cyberattacks, with a staggering 90% of these attacks involving social engineering. The consequences of social engineering can lead to significant financial losses, reputational damage, and the compromise of personal and organizational security. Therefore, understanding social engineering is vital. What is this deceptive art called "social engineering," and what are the main attack methods used by social engineers?

This article will shed light on a number of issues related to the concept of social engineering. Readers will understand the intricacies of these manipulative tactics through real-world examples and case studies. Additionally, key prevention techniques will be discussed to help individuals and organizations protect themselves from various types of social engineering attacks.

What is Social Engineering
In cybersecurity, social engineering is a pervasive and powerful threat. Key steps to improving defenses against this insidious cyberattack include understanding its definition, appreciating the importance of the human element, and understanding why it is considered a serious threat. To mitigate the risks associated with social engineering tactics, it is essential to be vigilant, informed, and have robust security protocols in place.

In the following sections, we will examine social engineering in detail, specifically the following key components of this phenomenon:

Social engineering as psychological manipulation.
The human element in cybersecurity.
Why social engineering is a serious threat.
Definition of Social Engineering
The term "social engineering" is used to describe a wide range of malicious activities carried out through human interaction. Social engineering is a form of psychological manipulation that exploits human behavior and tricks users into making mistakes to gain access to networks, systems, or sensitive information.

Unlike traditional hacking methods, which exploit technical vulnerabilities, all types of social engineering attacks target the human element of security. Using tactics such as deception, manipulation, and impersonation, attackers seek to trick people into revealing sensitive data or performing actions that compromise security. This reliance on human behavior makes social engineering particularly difficult to defend against.

The Human Element in Cybersecurity
In cybersecurity, the human element, the human factor, is considered the most vulnerable link in the security chain. No matter how robust technical defenses are, human error or poor judgment can lead to a security breach. Social engineers exploit this weakness, exploiting common human traits such as trust, curiosity, fear, and a desire to help.

Security breaches of this nature occur quite frequently because people tend to trust others, especially in situations where they are presented with compelling examples or urgent requests. Social engineers often impersonate trustworthy individuals—colleagues, IT staff, or even friends—to weaken their targets' control and obtain the information they need. Furthermore, in today's information-sharing world, people often unknowingly disclose their personal information online. This data can be harvested by attackers to create sophisticated social engineering attacks.

Social Engineering Attacks: A Serious Security Threat
Because social engineering attacks are widespread and quite effective, they pose a significant threat to individuals, organizations, and even governments.

The main reasons why social engineering attacks are a serious cybersecurity concern are:

Low Technical Barriers
Social engineering relies on exploiting human psychology, unlike traditional cyberattacks, which may require advanced technical skills or sophisticated tools. This low barrier to entry makes social engineering accessible to a wide range of attackers, from novices to seasoned cybercriminals.

High Success Rates
Social engineering attacks have a very high success rate compared to other cyberattacks. By exploiting human emotions and cognitive biases rather than advanced cyberattack technologies, attackers can manipulate people into sharing sensitive information or performing actions that compromise security measures.

Various Attack Vectors
Social engineering encompasses a range of attack vectors, including phishing emails, phone scams, pretexts, and lures. This versatility allows attackers to adapt their strategies to exploit specific vulnerabilities, making it difficult for individuals and organizations to defend against them.

Targeting Insider Knowledge
Social engineers create convincing scenarios by conducting thorough research and gathering insider knowledge about their targets. Using personal information or impersonating trusted individuals, attackers can deceive even alert individuals, who may let their guard down in familiar contexts.

Types of Social Engineering Attacks

Social engineering attacks gain unauthorized access to systems or sensitive information by exploiting human psychology. To develop effective strategies to prevent such attacks, it's important to understand them. Here's a brief overview of the most common social engineering attack methods:

Phishing Attacks
Phishing is a fraudulent attempt to obtain confidential information by masquerading as a trusted person in emails. The goal of phishing is to steal personal data, such as credit card numbers, login credentials, or other sensitive information. Phishing attacks are divided into the following types:

Email Phishing
The most common type of phishing is email phishing. In email phishing, attackers send emails that appear to come from legitimate sources, such as banks or reputable companies. When people click on these emails, which contain malicious links or attachments, the emails automatically capture sensitive information.

Example: Let's say you receive an email with the subject line "Urgent: Check your account details," which appears to be from PayPal. In reality, the email contains a link that takes you to a fraudulent PayPal page where you'll be asked to enter your user information. This constitutes an email phishing attack.

Spear Phishing Attack
Spear phishing, unlike regular phishing, is highly targeted. Attackers modify their false messages to target a specific person or organization. Thus, after researching their targets, they create personalized and persuasive emails that can lead to a data breach or unauthorized access.

Example: You receive an email that appears to be from a high-ranking executive in your business, asking you to view an important document located via a link. By using personal information, the email appears to come from a trusted source.

Whaling
Whaling is a type of spear phishing that targets high-ranking individuals, such as executives or senior officials within an organization. The likelihood of falling victim to the scam increases when messages are crafted to appear particularly urgent and relevant to the individual's role.

Example: A fraudulent email, apparently from a law firm, claims the CEO needs to review and sign an urgent legal document. The email contains truthful information and a link to a fake document designed to extract confidential information.

Pretexting
Pretexting involves developing a pretext or scenario to obtain information from a target. Attackers can persuade victims to disclose sensitive information by posing as a trusted company employee, such as an IT help desk representative. This method relies on a compelling backstory and often involves a combination of deception and social engineering tactics.

Example: An attacker calls a company's help desk, posing as a finance employee who has forgotten their password. To convince the help desk representative to reset their password and gain access to sensitive financial systems, they may provide detailed information about the company's internal procedures.

Baiting
Baiting attacks lure victims into a trap with the promise of something enticing, such as free software or prizes. These strategies often use physical or digital bait. This bait could be a USB drive left on the street or a download link on a fake website. Baiting often triggers the installation of malware or the disclosure of personal information.

Example: An attacker leaves USB drives labeled "Employee Payroll" or "Confidential Project" in a public place. When an inattentive employee connects the USB drive to their computer, it installs malware that allows the attacker to access the organization's network.

Digital lure example: A fake ad for a free software download that claims to improve system performance. Clicking the ad launches malware that looks like legitimate software, which can steal data or compromise the system.

Quid Pro Quo
The principle of a quid pro quo attack is as follows: attackers offer something in exchange for information. For example, they might offer a favor or reward in exchange for login credentials or other sensitive data. This type of social engineering often involves impersonating a technical support agent or other authorized person who needs the victim's information to help.

Example: An attacker masquerading as a technical support agent calls remote employees and offers them a free service or upgrade. They request login credentials or ask the employee to install software, which then allows the attacker to gain remote access to complete the process.

Tailgating
Tailgating, like another pretexting technique called piggybacking, involves physically gaining access to restricted areas by following an authorized person. Attackers can impersonate employees or contractors, exploiting the trust and goodwill of those who open doors for them. However, in tailgating, attackers gain access to a building without the knowledge of others. This method can be used to gain access to secure systems or facilities, as employees are unaware of who has just entered the building.

Example 1: A scammer waits at the entrance to a secure building and follows an employee through a door where they must identify themselves with a badge. To blend in with the crowd and gain access to restricted areas, the criminal may strike up a conversation or enter with the employee.

Example 2: An attacker poses as a courier carrying a large package and asks an employee to hold the door for them. In both cases, they may attempt to access sensitive areas or gather information once inside.

Vishing (Voice Phishing)
Vishing uses voice communication, typically over the phone, posing as trusted organizations to deceive victims and obtain confidential information. Attackers may pose as employees of a bank, government agency, or technical support service to trick victims into revealing personal or financial information. This type of social engineering exploits the perceived legitimacy of voice interaction.

Example: A scammer calls, claiming to be from a financial institution's fraud department, claiming that suspicious activity has been detected on the victim's account. To "secure" their account, they ask the victim to confirm their personal information or account information.

Example: A caller claiming to be from technical support informs the victim that there is a serious security issue on their computer. To resolve the issue, the victim must provide their remote access credentials or install software that allows the attacker to control their computer.

In both cases, the scammer gains access to sensitive information by the victim providing their credentials.

The Impact of Social Engineering on Organizations

As mentioned previously, social engineering attacks pose a significant threat to organizations: they can cause financial and data loss, reputational damage, and legal issues. The following sections provide an overview of the impact of social engineering on organizations, covering such issues and consequences as:

financial losses,
data breaches and reputational damage,
legal and compliance issues.
Financial Losses
Social engineering attacks can have serious consequences. Victims of social engineering attacks suffered an average financial loss of $1.8 million per incident. This amount includes both direct costs (theft, fraud, and recovery costs) and indirect costs (loss of productivity and business interruptions).

In addition to direct financial losses, organizations also incur costs associated with security upgrades, system repairs, and potential fines. For example, the 2023 IBM Security Report found that socially engineered data breaches cost an average of $4.88 million, highlighting the broader financial impact these incidents have on an organization's budget and resources.

Data Breaches and Reputational Damage
Social engineering attacks are the leading cause of data breaches. Not only do data breaches lead to financial losses, but they can also cause significant damage to a company's reputation. The 2024 IBM Cost of a Data Breach Report notes that 60% of affected organizations suffer long-term reputational damage after a breach. Clients and customers can lose trust in the organization's ability to protect their data, which can lead to a decline in business volume and potential loss of market share. An average of 45% of companies affected by a data breach report that their brand reputation has been impacted.