Gary Perkins, Chief Information Security Officer

October 25, 2024

Social engineers rely on two key psychological triggers: urgency and empathy. When people feel rushed or that they are helping someone in need, their normal critical thinking is often overridden. Attackers don’t just hack systems; they hack people, and they’re exceptionally good at it.

In today’s hyper-connected world, cybersecurity scams such as phishing, vishing (voice phishing), smishing (SMS phishing), and qishing (QR code phishing) are rampant. Social engineering tactics like these remain some of the most effective ways for cybercriminals to infiltrate organizations and steal data or money from individuals. Despite numerous warnings, policies, and technical safeguards, employees still fall prey to these scams. But why? The answer lies in human psychology and behavior. People fall for these scams not because they are uneducated, but because they are human.

Why Do Attackers Do It? Because It Works.

The reason cyber attackers continue to use these tactics is simple: they work. Social engineering targets human weaknesses rather than relying on technical exploits. The most sophisticated firewalls or endpoint security measures can be bypassed when someone willingly hands over their password or clicks on a malicious link. Attackers know this, and they exploit it effectively.

Consider a scenario where an employee receives a seemingly urgent email from their CEO, asking them to buy gift cards for a company event. The email, carefully crafted, appears authentic, and the request seems reasonable. Without a second thought, the employee purchases the gift cards and sends the codes to the attacker, only to realize later that it was a scam.

Why do these tactics work so well? Social engineers rely on two key psychological triggers: urgency and empathy. When people feel rushed or that they are helping someone in need, their normal critical thinking is often overridden. As cybersecurity expert Bruce Schneier once said, “Amateurs hack systems; professionals hack people.”

The Human Desire to Help

One of the key reasons people fall for these scams is that, fundamentally, people want to help. Even in organizations with stringent security policies, the human inclination to assist others can take precedence. Attackers play on this instinct, often creating scenarios that tug on heartstrings or invoke a sense of duty.

For example, consider Mark, an employee in a company with robust cybersecurity policies. He receives a phone call from someone claiming to be from the IT department, asking for his password to resolve an urgent issue. Despite knowing the company’s policy against sharing passwords, Mark provides it. Why? Because the attacker successfully created a sense of urgency that made Mark want to help more than he wanted to follow the rules.

This is a recurring theme in social engineering attacks: the attacker understands human nature better than the system’s designers. They manipulate emotions and circumstances to make their requests seem reasonable, bypassing the strongest policies and technological controls.

Cybersecurity Is Not Just an IT Issue—It’s a Human Issue

Cybersecurity programs traditionally focus on technical solutions—firewalls, encryption, antivirus software. However, policies and technology alone are not enough. At its core, cybersecurity is a human problem. Attackers don’t just hack systems; they hack people, and they’re exceptionally good at it.

Cybersecurity professionals often use jargon and complexity to describe the many components of security: threat actors, exploits, vulnerabilities, etc. However, the critical element often overlooked is human behavior. To improve security, we must recognize that people—not just machines—are a key part of any defense strategy.

It’s time to add “behavioral” controls to the list of standard security controls (administrative, technical, and physical). By understanding what motivates employees to click on infected links or share sensitive information, we can begin to build stronger defenses. Security awareness programs, when implemented properly, can yield the greatest return on investment because they focus on changing behavior.

AI and the Future of Social Engineering

The rise of artificial intelligence (AI) is poised to make these types of attacks even more dangerous. Imagine receiving a phone call from someone who sounds exactly like your CEO, asking you to perform a seemingly routine task. The phone number is spoofed, and the voice is indistinguishable from the real person. With AI-powered deepfakes, this scenario is not far-fetched.

AI allows attackers to create highly personalized and convincing scams, making it even harder for individuals to discern between real and fraudulent communications. This evolution of social engineering means that training employees to recognize phishing emails will no longer be sufficient. The ability to hear and trust voices will also be challenged, making trust verification an even more critical aspect of security protocols.

Why Do People Keep Falling for These Scams?

Despite the numerous warnings and training programs, people continue to fall for cybersecurity scams because they underestimate the likelihood of it happening to them. Many employees believe that these incidents only happen to others, and they don’t see themselves as potential targets. Distraction, stress, and the pressures of daily work further increase their vulnerability to these attacks.

In many cases, people think they are making a rational decision when, in reality, they are reacting emotionally. Faced with a request that seems urgent or empathetic, their judgment can become clouded.

The Path Forward

Cybersecurity is no longer just about protecting data and systems—it’s about protecting people. Changing human behavior is the key to reducing the success of social engineering attacks. While technology plays an important role, people are both the weakest link and the greatest strength in any security posture. By focusing on behavior and creating a culture of awareness, organizations can empower employees to be their strongest line of defense against cybercriminals.

About the Author

Gary Perkins is the Chief Information Security Officer at CISO Global. With 20+ years of industry leadership, Gary’s experience spans both the public and private sectors. Most recently, he served as the Chief Information Security Officer for all of British Columbia. Previously, he served as Chief of Staff for the Chief Security Office at Canadian multinational publicly traded holding company and conglomerate, Telus.

As CISO, Gary drives cybersecurity strategies and risk management initiatives. He holds a Master of Business Administration (MBA) in the Management of Technology and Bachelor of Arts in Psychology from Simon Fraser University in British Columbia, as well as a Diploma in Criminology from Kwantlen Polytechnic University. Additionally, Gary has earned more than 22 industry-related certifications and awards and serves on numerous boards and councils.

The post Cyber Scams & Why We Fall for Them appeared first on CISO Global.

*** This is a Security Bloggers Network syndicated blog from CISO Global authored by hmeyers. Read the original post at: https://www.ciso.inc/blog-posts/cyber-scams-and-why-we-fall-for-them/