Understanding how social engineering works in cyber scams – three tactics to watch out for

In partnership with the Canadian Bankers Association.

Staying cyber safe means knowing who to trust online. Even the strongest security systems can be vulnerable when people are tricked into giving away sensitive information like login credentials or account details.

Cyber criminals often use scams to scare, confuse or rush you into taking some sort of action through a process known as social engineering. Social engineering presents realistic messages with urgent requests to trick us into giving away our personal information that scammers can use to commit financial fraud. But these tactics are easy to spot when you know what to look for!

Three social engineering tactics to watch out for

• Fear as a motivator. Scams that use fear as a motivator often involve threatening or intimidating emails, phone calls and texts that appear to come from an authority figure, such as a police officer, the tax department or a bank. Cyber criminals hope to scare you into giving them your personal information or money.

• Urgent requests. Scams that use the tactic of an “urgent” request can involve suspicious emails, texts or phone calls that demand that you act quickly or there will be consequences. For example, the suspicious message might say that your bank account will be closed or that you’ll lose out on a deal.

• Irresistible opportunities. Some scams offer opportunities that are too good to be true. They are designed to trick you into providing sensitive information or downloading malware onto your device. Watch out for offers for free access to an app, game or program in exchange for login credentials. Other common scams include lottery or prize winnings or information about a lucrative job opportunity.

How to protect yourself

• Slow down and don’t let messages of urgency influence you. Always take the time to review the details carefully and research the facts before you take any action.
• Be suspicious of requests for your personal information. Your bank will never send you an email or call you on the phone asking you to disclose personal information such as your password, credit card number or your mother’s maiden name. Learn how to spot a phishing scam.
• Limit what you share online. You probably know that you should be careful sharing personal details about yourself, like your home address or phone number, online. Seemingly innocent information, like the name of your first pet, can also be used to steal your data.
• Install anti-virus, anti-spyware and firewalls purchased from trusted retailers or suppliers. Turn on automatic software updates when they are available in order to protect your devices against malware.
• Be wary of downloading free apps, files, programs, software or screensavers. Malicious code, like spyware (that secretly monitors what you do online) and keystroke loggers (that secretly track what you’re typing) can be hidden within the download and used to steal your personal information, such as login credentials.
• Use different passwords for each account. Using the same password for multiple accounts can lead to hacks across multiple platforms. Using a unique password for each of your accounts may seem like a lot of work, but it’s worth the effort to keep your information safe from cyber criminals. Use a password manager to store login data for all your accounts, so you can access them easily with just one primary password. Just make sure the primary password is your strongest one!

Sign up for the CBA’s free fraud prevention newsletter to learn about the latest scams and download your copy of the CBA’s Cyber Security Toolkit for Consumers, created in partnership with the Government of Canada’s Get Cyber Safe campaign and review Get Cyber Safe’s infographic on social engineering.