# Social engineering

"Social engineering" is using information about the person to get them to trust them. This can often include exploiting someone's willingness to help or get help.

Social engineer hackers are often *very* patient. They'll spy on someone for weeks and months to check for the following:

1. Something of [value](purpose.md) they can theoretically attain.
2. [Routine behavior](habits.md) that they can exploit.

This is more common when someone has more reason to do this, which scales as the opportunity to benefit increases. This is why "cyberespionage" is a standard risk for [all large institutions](groups-large.md), and why "cyberterrorism" is a frequent issue for governments.

There are many forms of social engineering:

- "Phishing" involves sending fake information (usually an email) that looks legitimate.
  - Standard phishing, like [cold-call sales](marketing-sales.md) or "spam" email, sends out many emails at once to get anyone gullible enough to give information.
  - "Spear phishing" is a highly sophisticated version of it that targets one person, usually with plenty of personal information.
  - CEO fraud and government phishing uses an official-looking email address (e.g., a CEO's company website, a government bureau).
  - Clone phishing copies a legitimate message with an attachment and sends an identical one with a virus instead.
  - Cloud phishing sends a link to a cloud service to download a seemingly legitimate file.
  - "Smishing" uses SMS text messages, which is often to circumvent [two-factor SMS authentication](cs-infosec-authentication.md).
  - "Vishing" uses voicemail messages to provoke someone to call a phone number or go to a website.
  - Whaling is phishing that specifically attacks members of upper [management](mgmt-1_why.md).
  - QR code phishing (quishing) uses QR code scans to get people to visit dodgy websites.
- "Pretexting" uses subtle appeals to or impersonations of reliable sources to gain that person's trust (e.g., "I'm from the FBI...").
- "SEO poisoning" uses illegitimate techniques to rank higher on search engines ("search engine optimization") to get people to go to their website.
- "Something for something" is giving something (usually free) to someone in exchange for their information.

"Ransomware" is software designed to block off information until someone pays money. By transferring the money through [cryptocurrency](cs-blockchain.md), it can be difficult to trace the transaction.

"Malvertising" is advertising designed to look like another legitimate product, but is actually [malware](cs-infosec-cysec-malware.md).

## Identity Theft

Typically, in a modernized society, hackers only need *very* few pieces of information to [authenticate](cs-infosec-authentication.md) themselves as someone else:

- Someone's full name, date of birth, and social security number are enough to fraudulently get a new [credit card](money-2_debt.md), [get insurance](money-insurance.md), secure a loan, and many other activities.
- A few pieces of information from social media can guess someone's [password](encryption.md) security questions.
- A passport number alone could allow multiple things:
  - Book an international flight as you
  - Apply for anything that requires proof of identity documentation with the government (e.g. working with children)
  - Activate a SIM card (and get an internet connection traceable to you, not them)
  - Create fake physical passports from a template, with the correct passport number (which they can use for many things such as crossing a border or opening a bank account)
- Without [multifactor authentication](cs-infosec-authentication.md), a password could allow someone to log in to a computer remotely or use that password/email combination on any other website.

On average, it takes 800 hours to resolve identity fraud.

- Good protection services will assign a counselor to clean up the mess.
  - Excellent services will also include proper identity theft [insurance](money-insurance.md).
- Don't get ID theft protection that only monitors credit reports, since several popular services (like [Credit Karma](https://www.creditkarma.com/) or the credit reporting company themselves) will monitor credit for free.

"Sim swapping" is when a hacker can acquire a phone number's [two-factor authentication](cs-infosec-authentication.md) by authorizing a cell carrier with fraudulent information to migrate that phone number to another phone.

## Victim profiles

While the elderly are susceptible to scams and fraud, younger people are *more* susceptible to it.

- This is because experience is the number one way to detect bad actors.

## What to do

In general, be *very* vigilant about all information you enter

- Consider the worst possible way that information could be used.
- Further, consider the secondary information that someone could derive with multiple pieces of that information.
- For privacy's sake, assume that everything you've ever said on a phone call or message is public information.

Even if a company is legitimate, your personal information is as safe as that company's server is safe from getting hacked.

- In other words, a high-profile company *will* be hacked, not *when*.
- In practical terms, it happens when someone accidentally left one setting selected on a computer somewhere, then one random (often teenage or incel) hacker found it.

Callers can clone voice recordings.

- If you're unsure of the number, let it go to voicemail, then look it up before calling them back.
- If that individual might be someone you know, send them a text message to be sure.
- When you *do* answer, expect them to use your voice to [train a machine learning algorithm](cs-ai-ml.md).

Do *not* enter your credit card info into something just because they need to "verify your age".

Trust your instincts.

- Many logins you could make will frequently seem legitimate, except they'll ask extra information.
- You don't need to "make a login" for a public site (e.g., Wikipedia).