The Monsters in Your Inbox: How to Spot Social Engineering
In horror movies, monsters smash through windows and hack through doors. However, real-life cybercriminals do not hack past firewalls anymore. They just knock on the front door wearing convincing costumes and ask to be let in.
Unlike trick-or-treaters who just want candy, cybercriminals have nefarious objectives. They are looking to steal company money, exfiltrate data or get their hands on user credentials.
The Ghost (The Spoofed Executive). An email arrives out of nowhere from a company executive. They demand immediate action, such as buying gift cards, transferring funds, or sending sensitive information. However, the email is from a cybercriminal hoping to trick you into doing what they want.
The Shapeshifter (The Vendor Impersonation). Someone claiming to be a vendor says their banking details have changed. They ask you to send payment for the next invoice to a different account. In reality, it is a cybercriminal who hijacked the vendor’s email account or intercepted an ongoing chat.
The Vampire (The Data Sucker). A notification looks like it came from Microsoft 365, Google Workspace, or your HR portal. It claims your password expired and you have a short time to change it before your account is locked. However, the notification came from a cybercriminal who will drain your credentials when you type them in.
These cyber “monsters” are effective because they exploit human psychology. They want you to act before you think and realize they are hiding behind costumes. However, they are not scary when you know what to look for.
Check the Mask. Closely inspect the sender’s full email address, not just their display name. If the address is slightly off, it is a phishing email.
Break the Spell of Urgency. If a message demands immediate, secretive action, it is almost always a trap. Take a breath.
Use the Silver Bullet. Never reply directly to a suspicious message. Call or text the sender on a known, trusted number to verify the request. “Hey boss, did you actually just email me to buy $500 in Apple gift cards?”
If you realize you accidentally clicked a bad link or gave away a password, do not hide it. Reporting it immediately gives IT a chance to stop the monster from spreading through the rest of the company’s network.
October is Cybersecurity Awareness Month, but vigilance is an everyday, all-hands-on-deck activity. Every user is a gatekeeper who can prevent an attacker from entering the network.