Social engineering

Social engineering is the use of deception and psychological manipulation to trick people into revealing information, granting access or taking actions that benefit an attacker.

Rather than breaking through technology, social engineers exploit trust, helpfulness, fear and urgency. Techniques include phishing emails, phone calls posing as IT support, texts claiming to be from a bank, fake job applicants and even people walking into an office pretending to be a contractor or delivery driver.

Small businesses are often close-knit and helpful, which attackers try to take advantage of. A caller who knows a manager's name, a recent project or a supplier relationship from social media can sound very convincing. Social engineering is behind many cases of payment fraud and account takeover affecting Canadian organizations.

Practical tip: create simple verification rules and stick to them. For example, confirm any change to banking details or any urgent payment request by calling the person back on a number you already have on file, never one provided in the message. Give staff explicit permission to slow down and check, even when the request seems to come from the boss.