What You Know…

It is your birthday, and you are probably overwhelmed with calls and messages from well-wishers. Suddenly, another call comes in, a voice tells you that you have a package from someone you know, and you simply need to read the code sent via SMS to claim it. It is your birthday, so it isn’t far-fetched, you excitedly read the code to them. Not long after, you get alerts showing that you have been logged out of your Facebook account and that the email and phone number are being changed.

You come online and read a story of how someone’s bank account was cleared out because they revealed their PIN to a “bank agent” who called to rectify some issues with the account.

Recently, someone made an X (Twitter) post raising awareness for a “new” method of accessing victims’ funds. A small amount of money would be sent to your account, and when you log in via your bank app or their website to investigate the transaction, your login details are captured and your account is cleared.

Ever received these SMSs purportedly from the government offering relief funds for whatever trending disaster is happening? COVID, hardship allowance, and the like? These SMSs always have a phone number attached for you to call to claim them. And when you call, you are asked to send a certain sum to claim your full amount.

These can be considered “low-level scams,” but they work; that is why they are still rampant. You may be reading these stories online skeptically thinking, “That can never be me,” but are you sure?

Imagine you are trying to access the entrance at work with your ID card and PIN, and you see this colleague laden with files and bags, and let them in. You are only being polite, yeah? Minutes later, the whole company is locked out of their server, and there’s a ransomware demand on your screen.

Or you are at work, and your bank sends an email to inform you that someone is trying to make purchases with your account. You panic and click the attached link, because your hard-earned money can’t go like that, and it is a phishing link that infects the whole network.

You attend a conference with your colleagues, and after dinner on the closing night, you see a company USB on the table and decide to help the unknown colleague who has it ensure it isn’t lost. You take it back to the office and plug it into your computer to investigate whose it is. You check, and it is mostly empty, and you can’t trace the owner. You put an announcement on the employee board and forget about it. Weeks later, the IT guys trace a worm infection to your system.

Let’s assume you are an accountant. One day, you get a call from your CEO, who is on vacation, to transfer some funds. The number isn’t his, but it is from the same area where he is vacationing, and it is actually his voice. Since it is an emergency, you transfer and in the next hour, you are facing HR, or worse, the police.

Or you heard what happened to your peer in another company, and as an accountant, you have learnt. When you get the call, you decide you require video evidence, and you actually have a video call with the CEO, and you see him. Days later, you are being probed for transferring funds without proper permission.

Let’s say it is the election campaign period, and videos and audios of candidates are circulating, all designed to discredit the candidate. Or there are suddenly recycled videos of tragedies made to look recent, with loud social media voices offering interpretations designed to cause panic and fear. 

Some organisations also use misinformation to push changes in subscription prices. Imagine that it comes out that your favorite telecommunications company is doubling its data, call, and SMS tariffs. After weeks of panic, it turns out that they actually increased these tariffs, but by 25%. The relief you feel that it isn’t a 100% increase would buffer the fact that there is an increase.

Do you still think you are “scam-proof?” Still think those who fall for these scams are simply not as tech savvy as you? The fact is, these techniques, Social Engineering in Cybersecurity, keep evolving, and AI has made them more compelling. Luckily, there are ways to protect you and your company.  Let’s explore these tactics, why they keep working, and how we can check them.

Social Engineering: The Evergreen Method

You can have digital and physical security, but there’s a part of security that is often overlooked but is very essential. This part involves the human factor, that is, where social engineering (and insider threats) come in. The organisation is only as strong as its weakest link…or something like that. In cybersecurity, humans are often the weakest link.

Social engineering is manipulating individuals into giving up sensitive information or taking actions that compromise security, without them even realising they’ve been duped. Unlike hacking that targets systems, social engineering focuses on people. Attackers exploit traits like trust, fear, curiosity, or the instinct to help.

Social engineering is a significant threat because it targets people. While firewalls and antivirus software protect against technical vulnerabilities, social engineering bypasses these defences by exploiting human psychology. This makes it particularly dangerous, as even the most advanced technical defences can’t fully protect against human error. 

These attacks occur in steps: Cybercriminals first investigate the intended victim using open source intelligence to gather necessary background information, such as routines, publicly available data on social media, potential points of entry, and weak security protocols; afterward, they make contact with the victim; finally, they proceed with the attack. Remember the birthday attack? 

Social engineering attacks work because, at their core, they aren’t a typical cyber attack. Instead, it is all about the psychology of persuasion: It targets the mind, aiming to gain the trust of targets, so they lower their guard, and then encourages them into taking unsafe actions such as divulging personal information, clicking on web links, or opening attachments that may be malicious. Simply: Humans are easier to hack than systems. 

Characteristics of Social Engineering Attacks

• They imitate popular, trusted brands: During their reconnaissance, the threat actors may find the bank that most employees use as their salary accounts and pose as the bank.
• Posing as the government or other authority: The government always announces one form of aid or another. Most threat actors capitalize on these to steal from people who fall victim. I mean, who wouldn’t want government aid? They also use people in authority because we wouldn’t want to compromise our jobs or relations with them, and would be more likely to comply.
• Inducing fear or urgency: If my carefully budgeted money is leaving my account and I get an alert, I would be overwhelmed with fear. That fear would push me to act to protect my money quickly. That is the simple logic these threat actors use. If I am offered a free vacation in Zanzibar and I have just 60 seconds to click to accept, I may react before I consider. 
• Appealing to greed: A large percentage of these scams work because they appeal to our greed. Imagine wanting to travel to seven countries with 150,000 naira, or something as preposterous.
• Appealing to “the need to help”: If someone who appears to be someone you know asks for help completing a survey or filling a form, with or without incentive, we would be inclined to help. If a picture or video of a child in distress is posted, more people are inclined to donate to the cause before verifying its legitimacy.

Popular Social Engineering Techniques

• Phishing: This involves using messages to prod victims into revealing sensitive information, clicking on links to malicious websites, or opening attachments that contain malware. Spear phishing is targeted towards a particular person, usually a top official, for a specific need.
• Baiting: In this case, the victim is promised something in a bid to access their confidential information or get access to their network. A free vacation can be offered, and when you access it takes you to a malicious website that harvests your information, or malware is downloaded into your phone. The perpetrators may also leave tempting items like USB drives lying around, and if a victim inserts it into their system infects the network with a worm or virus.
• Tailgating: The threat actor maneuvers their way into a restricted area by impersonating someone with a reason or right to be there, like a member of staff, maintenance personnel, or a delivery person.
• Scareware: The victim is sent scary pop-ups that prompt them to download malware or adware. Think of those messages that pop up to inform you that your device needs urgent cleaning when you visit some websites.
• Pretexting: The attacker pretends to be someone the victim is familiar with and asks a series of questions intended to gain personal information. 

With the rampant use of AI, social engineering techniques have also evolved. These noble techniques include:

• Deepfake Impersonation: Threat actors use deepfake videos and audio to impersonate key officials in an organisation and trusted individuals to gain personal information or finances. 
• AI-Advance Spear Phishing: Unlike previously, when a scam email could be identified with bad grammar and misspellings, AI chatbots make it easy for these actors to curate emails without grammatical errors, making them harder to detect.
• Business Email Compromise: These bypass legacy traditional systems and appear to be from high-level executives to trick trusted partners or employees into revealing sensitive information or transferring funds.
• Voice Cloning for Financial Fraud: With just a few seconds of audio from social media, scammers can clone voices to bypass security checks. This technique has been used to access bank accounts and authorize transactions, highlighting vulnerabilities in voice-based authentication systems.
• Romance Scams: AI has made it easier for criminals to build fake romance scams to convince vulnerable individuals to invest in financial investments or transfers.

Securing the Human Element in Your Cyber Strategy

• Cybersecurity Training: Educate employees on social engineering techniques and how they have evolved with the commonization of AI. Conduct simulations to train staff on how to recognise these threats.
• Segregation of Duty: Ensure that financial transactions or sensitive information are disseminated among individuals to ensure that one person does not have complete access to all the information, and financial transactions are initiated and approved by different individuals.
• Implement Multi-factor Authentication: This ensures that even if passwords are compromised, the other factors would ensure information or finances are uncompromised.
• Limit Personal Information Sharing: Encourage individuals to limit the information they post on social media, and to remember that any information willingly put out can be fair game for anyone who wishes to use it, especially criminals. 
• Invest in Advanced Security Solutions: Utilize tools that detect and prevent AI-generated phishing and deepfake content.

The threat landscape keeps evolving; thus, technical defenses alone are no longer enough. As AI makes social engineering attacks more sophisticated and psychological manipulation more convincing, organizations must recognize that modifying human behavior is now at the front line of cybersecurity.

Executives, HR, and IT leaders must collaborate to build a security-first culture where zero trust, awareness, skepticism, and smart verification are second nature. Whether through employee training, access controls, or real-time response systems, the cost of prevention is far lower than the price of a breach.

Invest in regular cybersecurity awareness programs, simulate phishing scenarios, and review your organization’s response protocols. Ensure your team knows how to identify, report, and neutralize social engineering threats before they become costly incidents.

Want to assess your organization’s human cybersecurity posture? Contact our team for a risk assessment or to schedule a tailored employee training session: chat with us on +2348133696849 or book a FREE consultation.