Social engineering

On 15 July 2020 attackers phoned Twitter employees posing as IT support, obtained their credentials and took over 130 accounts, among them those of Barack Obama and Elon Musk, for a bitcoin scam. Social engineering encompasses all psychological manipulation techniques by which an attacker deceives an individual by exploiting trust, authority, urgency or fear, to induce them to disclose sensitive information or perform an action that benefits the attacker, without resorting to any technical exploit on computer systems. Pretexting involves fabricating a credible scenario, for example posing as an auditor, an IT contractor or a line manager, in order to obtain access or information. Vishing (voice phishing) uses a telephone call with a spoofed identity. Business Email Compromise (BEC) attacks often combine social engineering and email spoofing to convince a colleague to make a fraudulent wire transfer to an account controlled by the attacker. The emergence of voice and video deepfake technology has considerably enhanced the credibility of social-engineering attacks by enabling convincing imitation of an executive's voice or face. For cyber insurance, social engineering raises a boundary issue between cyber cover and conventional fraud cover, depending on whether the fraudulent act involves a prior computer compromise.