Think Before You Share: How to Spot Social Engineering

2 days ago

4 min read

Not every cyber attack starts with clever code. Many start with a conversation.

Social engineering means manipulating people rather than hacking systems. Instead of breaking through your firewall, a criminal persuades someone to open the door for them: to share a password, approve a payment, click a link or let them into the building. It works because most of us are helpful, busy and inclined to trust.

The good news is that social engineering has tell-tale signs, and once you know them, they're much easier to spot.

How attackers use social media and public information

Attackers do their homework first, and much of what they need is posted online by us.

Job titles and org structure. LinkedIn shows who works where, who the finance team are, and who reports to whom.
New starters. A "delighted to join" post tells an attacker who doesn't yet know the people, processes or normal ways of working.
Holidays and out-of-office posts. "Away for two weeks" signals that a request "on their behalf" may not be checked.
Photos from work. Pictures of desks, screens, whiteboards or ID badges can reveal system names, building layouts or a badge worth copying.
Personal details. Birthdays, pets' names, children's schools and favourite teams are classic password and security-question answers.
Supplier relationships. Posts thanking a contractor or announcing a new partner tell an attacker exactly who to impersonate. Fake invoices and "new bank details" from a supplier you really use are far more convincing than a random scam.

What not to share, and how to lock things down

You don't need to disappear from social media. Just share with care.

Keep work detail high-level. Your role and company are fine. Internal systems, reporting lines and processes aren't for public posts.
Post holidays after you're back, not while you're away.
Check photos before posting. Look for screens, documents, badges, door codes and anything on the desk behind you.
Don't answer "fun" quizzes asking for your first pet, first car or mother's maiden name.
Review your privacy settings, limiting who can see your posts, connections and contact details.
Be choosy about connections. Accepting everyone gives strangers credibility with your colleagues.

The warning signs of social engineering

Whatever the channel, the same red flags keep appearing.

Urgency and pressure. "This must be done in the next hour" is designed to stop you thinking.
Authority or impersonation. Messages claiming to be from the CEO, IT support, a supplier or your bank.
Requests to bypass process. "Don't worry about the usual sign-off, I'll sort it later."
Payment or bank-detail changes. An "updated" account number from a supplier, customer or colleague should always be verified.
Requests for codes, passwords or MFA approvals. No genuine colleague or IT team needs these. (See our post on handling MFA push notifications safely for how fake IT calls try to get you to approve a prompt.)
Flattery or friendly DMs from new connections that build rapport before asking for something.
Moving the conversation off-platform, for example from LinkedIn to WhatsApp or a personal email address.
Odd links, attachments or QR codes, especially ones that lead to a login page.
Offers that seem too good to be true, from prizes to dream job offers.

Where it happens

Social engineering isn't limited to email. Watch out for:

Phone calls (vishing) from someone claiming to be IT, the bank or a supplier
Text messages (smishing) with links to "track a delivery" or "verify your account"
WhatsApp and messaging apps, including "Hi, it's me, I've got a new number"
LinkedIn DMs and fake recruiters asking for personal details or sending suspicious "job descriptions"
In person, such as tailgating through a secure door or an unexpected "contractor"

Check before you act

Our rule of thumb: if it's urgent and unusual, verify it first.

Slow down. Pressure is the attacker's main tool. A genuine request can wait five minutes.
Verify through a known channel. Call a number you already have, not one in the message, or speak to them directly.
Ask a colleague. A second opinion often spots what you missed.
Report it. Even if you didn't fall for it, tell IT. Someone else may be targeted next.

If you think you've slipped up

It happens to careful people too. Act quickly.

Tell your IT team or provider straight away. Speed limits the damage.
Change any password you've shared, and anywhere else you've used it.
Contact your bank immediately if a payment or bank details are involved.
Don't delete the message. It helps IT investigate.

What businesses can do

People are the target, so give them the tools to say no. We recommend:

Security awareness training and phishing simulations, so staff recognise the signs
A clear social media policy covering what can and can't be shared about work
Verification procedures for payments and bank-detail changes, such as a mandatory call-back to a known number
A simple reporting route, so staff know exactly who to tell and feel comfortable doing so
Limiting public org information on your website and social channels, such as detailed staff directories and reporting lines