Social Engineering, Phishing and Payment Fraud Explained

Social Engineering

Social engineering consists of manipulating or deceiving people in order to obtain information or make them perform an action, usually without them realizing the attack. Instead of directly attacking technology, the attacker exploits human behavior and trust. It is the basis of many cyberattacks, especially phishing.

Phishing

Phishing is a social engineering attack in which an attacker impersonates a legitimate or trusted entity in order to deceive the victim into revealing sensitive information or performing an action. It may use fraudulent emails, websites, domains or servers and can be used to obtain credentials, banking or personal information, money, or to make the victim open a malicious link or file.

Phishing Cycle

• Data acquisition: obtaining victim information
• Money mule: receiving and moving money
• Transfer, monetization or delivery: converting the proceeds into legal money

Money Mule

A money mule is a person who receives illegally obtained money and transfers or withdraws it on behalf of criminals, usually receiving a commission. Money mules are used to move criminal proceeds and make them more difficult to trace. Money muling is considered a form of money laundering.

Typosquatting

Typosquatting consists of using domains that closely resemble legitimate domains by exploiting typing errors or visual similarities, usually to deceive users and redirect them to fraudulent websites.

Advance Fee Fraud

Advance fee fraud is a scam in which the victim is promised a large amount of money, such as an inheritance, prize, lottery or investment return, but is first required to pay a fee in order to receive it.

The promised money normally does not exist, and the objective is to obtain the victim's advance payment.

CEO Fraud

CEO fraud is a type of fraud aimed at obtaining secret information or transferring large amounts of money using social engineering techniques. Attackers impersonate a CEO or powerful employee and use urgent requests, confidentiality or time pressure to bypass normal procedures. Emails may appear to come from legitimate or look-alike domains and usually target finance, accounting or procurement employees with access to payments. It is considered a targeted type of phishing.

Recommended measures include verifying unusual requests through another trusted channel and applying the four-eyes principle.

Skimming vs. Shimming

Skimming is the unauthorized capture of payment-card information, especially data stored on the magnetic stripe. Criminals may install modified or additional devices on ATMs or payment terminals to capture card data and may also use hidden devices to obtain the victim's PIN.

Shimming is a payment-card attack in which a very thin device called a shim is inserted inside a card reader, between the card and the reader, to intercept data exchanged through the card's chip contacts. Because the device is installed inside the reader, it can be more difficult to detect externally.