What is Social Engineering Fraud and How Can It be Prevented?

What is social engineering fraud, which threatens companies through “employee deception” tactics aimed at impersonation and persuasion, and how can it be prevented? 

The Sumerians, who lived in Mesopotamia thousands of years ago, are the actors in the first known fraud story in history, because according to archaeological outcomes, a merchant in the city of “Ur” 4 thousand years ago, was reported to the city’s officials for selling low-quality copper. Since ancient times, when two-factor verification technology was not yet on the agenda, fraud has continued unabated, increasing its impact to include the digital world. Today’s world, both the number of victims and the financial consequences of fraud are constantly rising. In this context, in 2023 alone, 2.6 million people were victims of cyber fraud features, and the number of losses incurred as a result of these illegal activities exceeded 10 billion dollars. According to the data in this context, a significant part of the frauds is the product of social engineering attacks. So, what is social engineering fraud and how can it be prevented?  

What Is a Social Engineering Scam? 

“If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” These words belong to Sun Tzu, a Chinese military commander, philosopher and military sage who lived in 500 BC. The method of tricking people for a specific purpose is called social engineering. It is also referred to as a social engineering fraud or social engineering attack. Sun Tzu emphasized thousands of years ago about the importance of knowing the enemy’s tactics, ironically the same concept is relevant to social engineering fraud today. 

One of the biggest cyber-attacks of the last 15 years took place in 2014. Cyber attackers illegally accessed to Yahoo systems and captured personal information such as names, e-mail addresses, phone numbers and encrypted passwords of 500 million users. The actor of the attack was a social engineering attack. The FBI announced that systems equipped with multi-layered security layers were obtained using social engineering methods.  

In summary, the attack began with a spear-phishing email sent to Yahoo employees and only one person had to click on the link in the content. A Lithuanian hacker then gained accessed to Yahoo servers by installing a backdoor and downloaded a copy of user data onto his own computer. 

Clicking on a single link can have such chaotic consequences, but more publicized discourses of social engineering attacks have also come to the fore. One of the most prominent scenarios is when hackers gather information about the CEO of a company, take over his e-mail account and have requests from employees.  

At this point, unfortunately, news of hackers sending fake emails pretending to be the CEO of the company, resulting in finance departments transferring Money to the hackers’ account, have unfortunately subjected over the years. 

By the way, while talking about social engineering, we should not forget the Nigerian Scam. The social engineering scam, which emerged at a time when e-mail technology was just emerging, was essentially based on the lie of a Nigerian princess was seeking for partners abroad for a large sum of money she wanted to get out of her country. Victims who believed the deception – and there were many – were defrauded by sending the small amounts of money demanded for a big payoff to the bank accounts of people they had never met. Some Nigerian Scam victims are known to have been defrauded of up to $50,000.  

Cyber fraud and social engineering operate in the same projection. According to IBM’s 2023 data, data breaches due to social engineering techniques resulted in an average loss of 4.5 million dollars. According to Statista reports, in 2022, 30% of the world’s adult population faced a type of fraud called phishing scams. Additionally, by the end of 2022, there were over 1.3 million phishing-focused fake websites worldwide. These results on the sophisticated threat landscape are far from optimism and underscore to the undeniable importance of social engineering fraud.