Social engineering scams, such as funds transfer fraud or phishing, are designed to manipulate or trick you into engaging with a scammer. The criminal’s goal is to get you to click on something, or gain access to your personal information or money.
Below are some examples of common social engineering scams I’ve encountered regularly as a cyber insurance broker.
If you run a business, having a cyber insurance policy is one of the few things that can help you get your money back.
Examples of Social Engineering Scams
Social engineering scams prey on our innate desire to trust others and be trusted. These scams rely on stirring the feelings of urgency, authority or curiosity in us to get us to react… There are many types of social engineering scams, some of which are listed below:
- Phishing: Unsolicited, faked emails target you hoping you’ll respond. Scammers use well-known brands like Apple, Dropbox, the IRS, Netflix, Microsoft, Facebook, etc. to trick you into clicking on the emails.
- Spearphishing: A more targeted version of phishing where the scammer is being specific about the person he/she’s going after. Inbound email may contain very personal information about you, hoping to get you to engage.
- Vishing (voice phishing): Inbound voicemails or artificial intelligence bots calling you directly with a message of interest, such as a loan, an important message from the IRS about your taxes, ,
- Smishing (SMS phishing): Unsolicited, inbound text messages like the ones below from people who claim to know you or are deliberately crafted to appear as “honest mistakes” by another person. iPhone may suggest adding them as contacts. Don’t respond or engage.
- Pretexting: The scammer fabricates a story to gain your trust before requesting specific personal information or other “help”. The smishing examples above could be a type of pretexting.
- Baiting: A tempting offer is made to you, such as a free download or prize. The offer is presented through a malicious website or fake of a legitimate website (such as a fake of one of the brands above).
- Pig butchering (romance scams): A criminal poses as a romantic interest to build a relationship with a lonely victim before requesting money or information, or blackmailing the victim once personal information has been provided.
- SIM Swapping: A SIM swap is a type of social engineering where a criminal poses as you to get your cellphone carrier to move your SIM card to a SIM card they control. This results in the criminal receiving all your SMS and text messages, including the 2FA codes that you may use to verify who you are with sensitive financial, crypto-related and/or health information.
- QR Code Phishing: Criminals will replace legitimate QR codes with malicious ones that link to a website they control. When a customer scans the malicious QR code, and follows the instructions to engage, their phone may be hacked, compromised or their personal information exposed.
- Deep Fakes: Criminals use artificial intelligence to mimic your voice or your appearance creating a video that appears to be you. This can be accomplished with as little as a profile photo from a social media platform and a few seconds of audio of your voice. Recently an employee was scammed out of $25,000,000 after thinking he was having a call with his company’s Chief Financial Officer (CFO).
Artificial intelligence makes all of the social engineering examples above easier. This is because the cost of faking text, audio and video at scale involves almost zero cost.
Indeed, scammers can a fake website or a popular brand almost for free in no time using artificial intelligence tools.
Funds Transfer Fraud Example
One of the most common online/cyber social engineering scams today is known as Funds Transfer Fraud (FTF).
FTF is a social engineering-based crime that targets companies or individuals through email, voicemail, and text scams…
The graphic below and the video above walk through an example involving an all too common situation involving a spoofed business invoice that tricks you into sending funds to the wrong person.
Understanding Funds Transfer Fraud: A Real-World Scenario for Businesses
Imagine two companies in the book publishing industry: Company A and Company B.
Company A is a publisher and Company B sells supplies, and Company A regularly purchases supplies from Company B.
Unbeknownst to them, a cyber criminal has infiltrated Company A’s computer network and is monitoring communications between the two companies.
The criminal is quietly watching and learning things about Company A and Company B, such as:
- How the companies communicate with each other and the tone of their emails, language used, etc.
- What types of transaction activity they are engaged in
- Which type of accounting software does each company use
- What banks do they use
- When do the companies expect to receive payments from each other
- What their business invoices look like
- What other companies do they work with
- Etc…
In this hypothetical scenario, after Company A purchases some supplies from Company B, the criminal knows that Company A owes Company B money. The criminal also knows that someone named John Smith at 99Supply works in accounts payable, knows his email address and that he handles the invoices that are sent to Company A.
So, the criminal seizes this opportunity to get in the middle of the transaction. The cyber criminal buys a domain name that is similar to Company B’s domain. For example, if Company B is called “99 Supply” and their domain is 99Supply.com1, the criminal might purchase “99Supplys.com” or “99-supply.com”.
The criminal then creates a fake (spoofed) invoice and sends an email from “john.smith@99Supplys.com” an email that looks almost identical to a legitimate one from Company B’s accounts receivable department, from the phony domain name.
The accounts payable person at Company A doesn’t recognize the misspelled “99supplys.com” domain name and pays the spoofed invoice which directs funds into the criminal’s account.
Weeks later, Company B, having never received the payment, follows up to check on the payment from Company A.
Company A insists they’ve paid, but the money is gone because it was already transferred to the fraudster.
The bank can’t recover the funds, and both companies are left in a difficult position of wondering who’s at fault and what recourse they have.
Who’s Covered? The Role of Cyber Liability Insurance
This scenario raises a critical question: Who is responsible, and will insurance cover the loss?
It depends on whether or not either company or both companies have cyber liability insurance. Cyber liability insurance should include coverage for social engineering and funds transfer fraud. It should also include first party and third party coverages.
- Company B’s Perspective: If Company B has cyber liability insurance with social engineering and funds transfer fraud coverage, it typically only covers losses if Company B itself is tricked into sending money. In this case, Company B is out of luck and may need to pursue legal action to recover the funds from Company A.
- Company A’s Perspective: If Company A has cyber liability insurance coverage with social engineering and funds transfer fraud, they should be protected—depending on the amount of the fraud, the policy’s language, sub-limits, and deductibles.
While the word “cyber” is found in many insurance policies, sometimes it is only mentioned in the form of recommendations about cyber risks, outside of the policy form itself.
As such, coverage for social engineering is not guaranteed it is explicitly covered and limits vary by insurer and policy details.
Have a knowledgeable cyber liability insurance broker review your insurance policies to advise you on what’s best for your situation.
Key Takeaways on Social Engineering Scams
Social engineering is a massive multi-billion dollar per year problem…2 The criminals are sophisticated, organized and the social engineering scam examples above have never been easier for criminals to use to target you.
Luckily, cyber liability insurance is still a relatively affordable type of business insurance and can be a crucial safeguard in a world where we are at constant risk of being the victim of online social engineering scams.
Unfortunately, with advances in artificial intelligence, it’s almost impossible to verify the authenticity of anything digital without confirming using analog means or multiple methods of communication with the other party.
As such, take the following steps to avoid being scammed when sending funds, even to parties you always do business with:
- Question: Consider any inbound communication requests about business accounts, especially with security implications, to be suspect.
- Verify: Always verify payment instructions, especially when requests for changes arrive via email.
- Educate: Inform your team about common social engineering tactics and the associated risks and how to spot suspicious communications.
If you have questions about cyber liability insurance for your business, or want to ensure your business is protected, schedule an appointment with me at the link below.
Footnotes
- As of the writing of this blog post, "99supply.com" is not a registered domain...
- Indeed, the U.S. Department of Justice (DOJ) recently announced the arrest and seizure of illicit funds in a massive "pig butchering" scammer ring out of Cambodia that had generated over $15 billion in revenue by scamming people using romance scams over the Internet.
