Social engineering: How fraudsters manipulate trust and behaviour

Contents:

• What is social engineering?

• Why does social engineering work so well?

• What methods of social engineering are there?

• How can you recognise social engineering?

• What should you do if you receive a suspicious message?

• What should you do if you’ve already responded?

• How to protect yourself against social engineering

• Conclusion: Check first, then act

What is social engineering?

Social engineering refers to the deliberate psychological manipulation of people to persuade them to take actions that could harm themselves or their organisation: revealing passwords, transferring money, opening doors or installing malware.

In doing so, attackers deliberately exploit trust, a willingness to help, authority, fear or time pressure. Rather than looking for a technical security vulnerability, they try to get people to bypass security rules themselves.

In doing so, the attacker does not hack the system, but rather exploits trust.

Why does social engineering work so well?

Social engineering works because fraudsters deliberately exploit human reactions. They create situations in which we act quickly, offer help or place our trust in others – rather than checking things more carefully.

• Authority: A supposed manager, government agency or IT support team appears credible and is therefore often less likely to be questioned.
• Time pressure: ‘Your account will be blocked in 24 hours!’ Statements like this are designed to create stress and prompt you to act quickly.
• Willingness to help: A supposed colleague, family member or customer urgently asks for help – thereby exploiting our willingness to assist.
• Curiosity and reward: Exciting information, a supposed prize or an exclusive offer are designed to tempt you into thoughtlessly clicking on a link, opening a file or connecting an unknown device.
• Fear: Threats of financial loss, legal consequences or blocked accounts are designed to prevent victims from taking the time to assess the situation calmly.

The more strongly a message triggers an emotional reaction, the more important it is to pause for a moment and assess the situation independently.

What methods of social engineering are there?

Social engineering takes many forms. A fraud attempt may begin via email, text message or telephone – or with a QR code, a fake website or a made-up story. Often, several methods are combined.

• Phishing: Fake emails are designed to trick you into clicking on a link, opening an attachment or entering your login details.
• Smishing: The scam arrives via text message or a messaging service – for example, as a purported parcel notification or a bank warning.
• Vishing: Fraudsters ring up and pretend to be, for example, a bank, a government agency or IT support.
• Spoofing: Telephone numbers, email senders or websites are manipulated to make a scam appear as genuine as possible.
• Quishing: Manipulated QR codes lead to fake websites or payment pages.
• Pretexting: Fraudsters invent a credible story to obtain information or prompt a specific action.
• Baiting: A supposed benefit – such as a prize, a free download or a found USB stick – is intended to arouse curiosity and tempt people into acting carelessly.
• Artificial intelligence is also playing an increasingly important role: AI can now be used to generate deceptively genuine messages, images or even cloned voices. That is why, now more than ever, it is not the first impression that counts, but independent verification.

How can you spot social engineering?

Social engineering often appears credible because the initial contact seems familiar, urgent or personal. It is therefore not just who is contacting you that matters, but above all what is being asked of you.

Pay particular attention to these warning signs:

• Unexpected contact: A bank, government department, colleague or service provider suddenly gets in touch with an unusual request.
• Time pressure: You are asked to respond immediately, authorise a payment or confirm details.
• Sensitive data is requested: You are asked to disclose passwords, PINs, TANs or security codes.
• Unusual payment requests: You are asked to transfer money, buy vouchers or confirm a payment.
• Suspicious links, attachments or QR codes: You are asked to enter details or install software via these.
• Check the sender and link destination: Hover your mouse over the sender’s address, a link or a button without clicking on it. Check which address is actually behind it and whether it is plausible.
• Requests for secrecy: Statements such as ‘Don’t tell anyone about this’ or ‘This must remain confidential’ are a clear warning sign.
• Unusual behaviour: Someone you know suddenly writes in a different way to usual or uses a new means of communication.

Remember: the more urgent, unusual or confidential a request appears, the more important it is to verify it independently.

What should you do if you receive a suspicious contact?

Does a message seem odd, is a caller putting pressure on you, or does a request seem out of place? If so, don’t react straight away – check it out first. Even taking a moment can help you spot an attempt at fraud.

• End the contact: Don’t let yourself be pressured. If you receive a suspicious call, you can simply hang up.
• Do not disclose any sensitive data: Do not give out any passwords, PINs, TANs, security codes or card details.
• Good to know: Swiss Bankers will never ask you by email for your full card number, login details, PINs, TANs or security codes.
• Do not open or install anything: Do not click on suspicious links, do not open unknown attachments and do not scan unexpected QR codes.
• Verify the request yourself: Contact the person, bank or organisation in question via a known or official channel.
• Do not authorise any payments: Only confirm transactions that you have initiated yourself and can clearly identify.
• Report suspicious contact: You can report attempted fraud to the National Cyber Security Centre (NCSC). If necessary, also inform the company concerned or your bank.

Important: Never use the contact details or links from the suspicious message to verify anything.

What should you do if you’ve already responded?

A wrong click or a careless authorisation can happen in the blink of an eye. It is crucial to act swiftly now to limit any potential damage.

• If you’ve entered your password: Change the affected password immediately via the official website or app. If you use the same password for other services, change it there as well.
• Bank or card details disclosed: Contact your bank or card provider straight away and check your transactions. If you suspect any unauthorised use, you should block the card in question immediately.
• PIN, TAN or security code disclosed: Inform your bank or card provider without delay.
• Payment authorised: Contact your bank as soon as possible to limit further damage.
• Software or remote access installed: Disconnect the device from the internet and have it checked. Then change any important passwords from a trusted device.
• Document the incident: Keep a record of messages, screenshots, telephone numbers and other information. In the event of financial loss, these may be important when making a report or filing a criminal complaint.

The quicker you react, the better you can limit further damage.

More control with the Swiss Bankers app

With the Swiss Bankers app, you can block your card immediately if necessary, use geoblocking, activate push notifications and check your transactions. This allows you to spot suspicious activity more quickly and limit potential damage.

How to protect yourself against social engineering

Social engineering cannot be completely prevented. However, by adopting a few simple habits, you can significantly reduce the risk:

• Question unexpected requests: Always verify unusual requests via a second, independent channel of communication.
• Use passkeys or strong two-factor authentication: these make it more difficult for stolen login details to be misused.
• Enable notifications: Push notifications for logins or transactions help you spot unusual activity at an early stage.
• Use official access points: Preferably use the official app, saved bookmarks or web addresses you have entered yourself.
• Be sparing with personal information: The less fraudsters know about your bank, your employer or your personal circumstances, the harder it is for them to construct credible stories.
• Keep devices and apps up to date: Regular updates patch known security vulnerabilities.
• Raise awareness amongst those around you: Talk to family members and colleagues about current scams – particularly those who have less experience with digital fraud attempts.

Conclusion: Check first, then act

Social engineering is so successful because it exploits not technical vulnerabilities, but human traits such as trust, a willingness to help and respect for authority. This is precisely where we can make a difference: if you know the tricks, you’ll remain more vigilant. Often, simply pausing for a moment is enough to recognise and stop an attack in time.