Social engineering is the use of psychology to manipulate someone into performing particular tasks or providing information to a scammer. In some cases, information is volunteered because it isn’t necessarily thought to be significant, such as a driver license number. However, all personal and professional information is subject to use by cybercriminals. What is done with the information varies based on the objective of the con artist.
A common misconception is that an employee would obviously know if a criminal came into a facility. While some robberies may indeed be obvious, in other cases criminals will attempt to fly under the radar, often committing crimes directly in front of employees without them ever suspecting a thing. This is where on-site social engineering comes into play.
The hardest part for a criminal is actually gaining access to the facility. It’s rare that a criminal can simply walk into a facility and say “Hi, I’m here to work on the phone lines” and an employee would simply give him access. Yes, there are still a few people out there who might make a crazy mistake and let someone like this in, but in most cases you hope that some phone calls would be made to verify that the unexpected visitor is actually legitimate and that was truly supposed to be working on the air conditioning or spraying for ants.
Criminals understand that the odds for success are pretty limited if they simply show up unexpectedly. To solve this problem, they often turn to email. Each day millions of business-related emails are sent throughout the world. The research firm, Radicati estimates that for 2018, over 281 billion email messages (both business and consumer) will be exchanged each day. They project that number to increase to over 333 billion by 2022.
Often these emails are communications between supervisors and their employees on tasks that need to be completed. For example, an email may contain a memo outlining a new work policy or a request for information that is needed for an upcoming meeting. Criminals have realized they too can send emails to employees; only these emails often lead to full access to the facility.
The criminal will generally start by doing a little bit of research about the organization. This information includes how many offices the company has, if there is a property or facility manager, who are the managers at the different offices, and even what third party vendors are known to work with the organization. Using this information, the attack begins.
Let’s say for example that an organization has multiple offices. A financial institution, for example will have several branch locations. For the criminal to gain access to these locations, they could send an email that appears to be on behalf of the organization’s facility manager. The email would be sent to each branch manager and include a message telling them that a worker has been scheduled to visit their facility to do maintenance on the air conditioning unit. The email will look 100% real, including the sender’s first and last name as well as email address and the corporate logo. If the recipient replies to the email, instead of being sent back to the real facility manager, it will be sent to the criminal, allowing him or her to continue the email conversation.
In other cases, an organization may only have a single facility. In this situation, the criminal would send the email from the property manager. She may explain that a pest inspection has been scheduled and someone will be on site on a specific date. Again, the email will look very real and unless the recipient actually picks up the phone and calls the person who supposedly sent the email, there is no way it could be known as a forgery.
This is why it is so important to verify unsolicited emails with a phone call. By picking up the phone and calling the supposed sender, you eliminate the ability for the criminal to hi-jack the conversation and establish that the information provided in the email is truly accurate. If you have to email the person, don't reply to the suspicious email, start a new one.
Remember not to dial the phone number that might be included in the email itself. Instead, go to your own records and look up the organization’s number or get it online through the website.
It is important that even if the visitor or vendor has authorization to be on-site, that they are never left alone. First, this could be a very good scammer and manipulated their way into the facility. Second, crimes of opportunity are far more common than anyone wants to believe. To be safe, non-employees should have an escort.
By literally taking one or two minutes to make the phone call, you can completely eliminate the ability for a criminal to schedule an appointment to gain access to your facility. In addition, if you do discover that you have received a malicious email, make sure you send out a warning to the rest of your organization to make sure no one else falls for a similar type of attack.
SUBSCRIBE TO WEEKLY NEWSLETTER
