Social engineering
Learn how to protect yourself and your family from scammers who use the art of manipulation to steal your personal and financial information.
What is social engineering?
Social engineering is the practice of manipulating or tricking people to overlook important security measures and give up their confidential information. Fraudsters will use social engineering scams to convince unsuspecting individuals to:
Select a malicious link
Open a malicious attachment
Hand over confidential information
Grant unauthorized access to your personal and financial information
Transfer funds
Share passwords
How do scammers manipulate people?
Scammers manipulate people by exploiting their basic human instinct to be helpful, trusting, and curious and to respond to urgent requests. They use a variety of tactics to lure people into sharing sensitive information that can be used to commit financial fraud or identity theft. Find out more about fraud prevention.
Always exercise caution when communicating with someone you’re not familiar with who appears to be using one or more of these forms of manipulation:
Making an emotional appeal
Communicating a sense of urgency
Instilling a sense of fear or excitement
Pushing to build a rapport with you
Social engineering tactics
Here are some of the different social engineering tactics commonly used by scammers.
Why social engineering?
With advances in anti-malware, software, and other cybersecurity controls, fraudsters are often on the lookout for easier targets. Fraudsters will also use social engineering as a first step in a larger plan to breach a system or network or to steal sensitive data.
There are a variety of methods used to manipulate you into sharing sensitive information or granting access to an authorized person. Let’s take a look at the different types of social engineering attacks.
Types of social engineering scams
-
Phishing/Vishing/Smishing
What are they?
These are the most common types of social engineering attacks.
Phishing is a form of social engineering in which fraudsters use email to trick the recipient into divulging personal or financial information that can be used for fraud.
Emails tend to look authentic, featuring corporate logos and layouts similar to the ones used by institutions for legitimate communication. Because these emails can look so official, unsuspecting recipients may reply to them, resulting in financial losses, identity theft, and other fraudulent activity.
A type of phishing to look out for is called spear phishing.
Spear phishing is a targeted attempt to steal sensitive information, such as account credentials or financial information, from a small group of individuals or a specific victim, for malicious reasons.
This is achieved by acquiring personal details on a specific person, such as their friends, hometown, employer, locations they frequent, and recent online purchases. This information is often collected from poorly secured social media profiles.
The attackers then disguise themselves as a trustworthy friend or entity to acquire sensitive information, typically through email or other online messaging.
Vishing is the telephone equivalent of phishing. It’s the act of using the phone to scam people into surrendering sensitive information that will be used for identity theft. Often a fraudster will call you to try and trick you into revealing sensitive information like your password, threaten you about phony debts that you owe, or attempt to trick you into paying a fee or debt with gift cards.
Smishing is another form of phishing in which scammers use texting or SMS messaging to try and obtain sensitive information from the recipient. Scammers will send you a text message with a link to claim a phony prize, update your password or visit a malicious website for great deals or interesting information.
Scam examples
Phishy calls and texts
You might receive a phone call or text message that appears to be coming from your bank, asking you to confirm information about yourself or your account. If you ever receive a call or message like this, do not respond or provide any information. Instead, contact your bank by phone to confirm the validity of the information requested.
Another common scam is to send a message, phone call, or email saying that you’ve won a free product, trip, or cash. And in order to claim your prize, it’s important to act now and send either information or money.
A good rule of thumb in fending off these kinds of scams is that if it sounds too good to be true, it probably is.
Law enforcement or government agency scam
Another common scam that creates a false sense of heightened urgency is the law enforcement or government agency scam. This scam occurs when you receive a phone call (sometimes from an automated recording) advising that you owe money to the government for taxes or there’s a warrant out for your arrest. The goal is to once again create a sense of urgency and fear to force you to give away sensitive information or money to solve the problem quickly.
How to protect yourself
If you ever have any suspicions, do not respond to emails, select links, open attachments, or provide sensitive information to unknown senders or organizations (even reputable ones) requesting personal or financial information online or over the phone.
Scotiabank will not send an email or text message that asks you to provide, confirm, or verify personal or financial information.
-
Malware
What is it?
Malware is a term used to refer to a range of malicious computer software programs.
Malware is designed to infiltrate, damage, or disable computers and networks or interfere with their functionality.
These programs include computer viruses, Trojan horses, spyware, adware, and keystroke loggers.
New types of malware are always emerging, so it’s important to stay on top of updates to your anti-virus or anti-malware software and to install operating system (OS) updates as they become available.
Malware examples
Computer viruses
On a basic level, a computer virus is a malicious program that, when loaded onto a user’s device, will spread by replicating and inserting itself in other programs and files.
Trojan horses
A Trojan horse (or Trojan virus) initially presents itself as legitimate and useful software that you may need, but it’s actually a disguise for a malicious file.
Spyware
Spyware is a form of malware that, once installed, spies on your device activity with the aim of stealing sensitive information to sell for profit. The theft and sale of your data could lead to identity theft.
Adware
Adware is software that displays unwanted ads, often with constant pop-ups, when you’re browsing the internet.
Keystroke loggers
Keystroke loggers can track the keystrokes (the keys you enter on your keyboard) on your computer or mobile device, stealing login and password information.
Find more information about scams that target personal information.
How to protect yourself
Malware is one of the most common forms of a cyber-attack. There are steps you can take to increase your security and make yourself less vulnerable.
-
Ransomware
What is it?
Ransomware is a type of malware that’s on the rise, both for personal and business devices. Attackers will infect your device with malicious software that will encrypt (lock) your files and then demand ransom payment to unlock your data.
One of the most common delivery methods is through phishing emails. Malware will be disguised as email links or attachments you were not expecting.
Once installed on your computer, ransomware can remain dormant until the scammer activates it to encrypt your files.
When files are encrypted, neither you nor an IT professional will be able to unlock your data. The only person that can grant you access is the scammer.
Scammers will demand a ransom payment to decrypt and unlock the files, but there are no guarantees that they’ll unlock your files or that they won’t sell or leak the information online.
Ransomware examples
Bad Rabbit
First spotted in 2017, Bad Rabbit is an example of ransomware that encrypts your files and demands a ransom be paid in the cryptocurrency Bitcoin.
WannaCry
In 2017, scammers secretly uploaded malware called WannaCry to thousands of computers around the world by exploiting an outdated version of Windows.
Cerber
Cerber is an example of the way scammers collaborate on ransomware to infect computers. Criminals can use it to share their profits with the malware’s designers.
How to protect yourself
It can be very difficult to decrypt your files and remove the ransomware from your computer. If you think your system has been infected with ransomware, consider trying the following:
Report an incident or suspicious activity