A Brief History of Phishing, and Other Forms of Social Engineering

Social engineering attacks have a very long history, though the Internet has made it easier to launch these attacks en masse, according to Sean McNee at DomainTools. McNee points to an advance-fee scam from 1924, in which a crook sent a letter pretending to be trapped in a Spanish debtors prison.

The sender requested that the recipient send a check for $36,000 to pay off his debt. After the sender is freed, he promises to pay the recipient back, with an extra $12,000 for the trouble. Criminals still use this scam today, often posing as Nigerian princes.

Here are some best practices DomainTools offers to help users avoid falling for social engineering attacks:

• “Look out for unsolicited emails, messages, or phone calls, especially if they request sensitive information or immediate action. Phishing messages can create a sense of urgency or fear to pressure recipients into quick responses."
• If an offer seems too good to be true, it most likely is. Scammers use enticing offers to lure victims.
• “Ask someone else for their opinions on a specific email or interaction. Sometimes a second review on a suspicious interaction can help you see the scam for what it is."
• “Use multifactor authentication (MFA) for your accounts online, especially accounts with sensitive personal information such as your finances or email. Never give your MFA code to anyone who asks for it, only to the service webpage you are actively logging into."
• “If you’re part of a critical business process, such as approving wire transfers, establish a secondary out-of-band process to validate these transactions. If you are in the same physical office, for example, agree to talk to the other approver face-to-face. If you’re remote, create a second communications channel, like text messaging, phone calls, or Slack, for approvals.”

KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

DomainTools has the story.