Social Engineering: Tis the Season for Tricky Hackers

With the holidays on the horizon, spirits are high—and it’s those same high spirits that hackers want to exploit. ‘Tis the season for clever social engineering attacks that play on your emotions, designed to trick you into giving up personal info or access to your accounts.  

Social engineering attacks unfold much like a confidence scam. A crook takes advantage of someone’s trust, applies a little human psychology to further fool the victim, and then pulls off a theft. Online, a social engineering attack will likely involve a theft attempt of personal or account information that the crook can then use to make purchases, drain accounts, and so forth. 

Not at all in the holiday spirit, right? Let’s take a look at some of their top tricks so that you can spot and avoid them. 

As said, spirits can get high this time of year. There’s looking forward to gatherings with family and friends, the fun that comes along with hunting for that perfect gift, and the excitement of the holidays overall. And that’s what hackers count on—people getting caught up in the rush of the holidays, to the point where they may not look at emails, offers, shipping notices, and such with a critical eye. That’s how the scammers get their foot in the door. 

Some of their favored tricks can look a little like this: 

1. Special access to hard-to-get holiday gifts. 

What are the holidays without that trendy “must-get” gift item, the one that’s seemingly out of stock no matter where you look? Scammers are keen on these items as well and will prop up phony ads and storefronts that pretend to sell those items but really don’t. Instead, they’re just a shady way for them to steal your debit or credit card information—or to lift a few bucks out of your pocket in return for nothing. 

One way to keep from getting burned by one of these scams is to follow the old adage, “If it looks too good to be true, it probably is.” In this case, crooks are using feelings of scarcity and urgency to get you to bite. Here’s where you can take a moment before you click to do some research.  

• How long has the company been around?  
• Are there reviews of this company?  
• Do you have friends who’ve shopped with them before (and had a good experience)?  
• What is their listing with the Better Business Bureau (and do they even have a listing)? 

Answers to these questions can separate the good businesses from the bogus ones. 

2. Gift card and coupon scams. 

Like the above, crooks will create a sense of urgency about a hot holiday item or limited time offer. The twist comes when they request payment via a gift card rather than by credit or debit card or other legitimate online payment methods. This request is highly deliberate because gift cards are much like cash. Once the money on the card is spent, it’s gone, and these cards do not offer the same protections that come with other payment methods. 

You can avoid this one easily. If anyone asks you to use a gift card as payment, it’s a scam. Gift cards are for gifts, not payment, says the Federal Trade Commission (FTC). If you come across such a scam, you can report it to the FTC as well. 

3. Charity scams. 

Donating to a charity in someone else’s name is often a popular gift. Much the same, giving a donation to a worthy cause feels particularly good this time of year. Once again, scammers will take advantage of these good intentions by propping up phony charities designed to do nothing more than dupe you out of your money. Whether that’s a flat-out phony charity or one of the many other scam charities that have been known to pocket 90 cents of every dollar donated, this is the time of year to be on the lookout for both. 

The advice here is much the same as the advice for avoiding phony businesses and retailers. Do your homework. The Better Business Bureau maintains a listing of charities that can help you make good donation choices. Also, your state government’s charity officials can help you separate good charities from bad—and even file a report if you suspect a scam is at play. 

And once again, if a charity is asking for donations in the form of cash, gift cards, or wire transfer, just say no. That’s a surefire sign of a scam. 

4. Phony shipping notices. 

Scammers know you have packages in transit this holiday season, loaded with gifts that you’re eagerly tracking. Enter another classic scam—the phony shipping notice. The idea is that you already have so many packages on their way that you won’t think twice about opening an email with a “shipping notice” that comes in the form of an attachment. Of course, that attachment is a fake. And it’s loaded with malware.  

Too bad for scammers, though. This is another one you can steer clear of rather easily. Don’t open such attachments. Shipping companies will almost certainly send along notices and invoices in the body of an email, not as an attachment. If you have a question, you can always visit the shipper’s website and look up your tracking info there. Likewise, follow up with the customer service department of the company that you purchased the item from in the first place. 

Yet more ways you can protect yourself from holiday scams 

While the holidays are a special time for scammers too, there are several things you can do to up the level of your protection now and year ‘round. A quick list includes: 

• Secure your devices and set your email spam filters. If you haven’t already, secure your devices with comprehensive online protection. With that in place, it can prevent you from mistakenly clicking risky links and downloads, blot out spam emails before they reach your inbox, and protect your accounts with strong, unique passwords. 
• Protect your identity too. Another thing that comprehensive online protection should cover is you. With identity theft protection, you can protect yourself. It can monitor dozens of different types of personal info along with your email addresses and bank accounts—plus provide theft insurance and support from a licensed recovery pro if identity theft, unfortunately, happens to you. 
• Beware of downloads you aren’t expecting. This is always good form because hackers love to spike downloads with malware designed to steal your personal information. Whether you get an unexpected attachment from a friend or business, follow up with them before opening it. If they say they didn’t send it, that’s a quick way to find out whether the attachment is legitimate or not. 
• Keep an eye out for typos and poorly crafted messages. Scammers may know a thing or two about human nature, but that doesn’t mean that they’re the best writers, designers, and website developers. A common sign of a scam is an email, ad, message, or site that simply doesn’t look or read right. Granted, some scammers have gotten quite good at making their scams look legitimate, yet many still fail to clear that bar.  

Keep the good feeling going this holiday season 

No doubt, the holidays have a feel all to themselves, one which hackers and crooks want to take advantage of. They’ll craft their tricks accordingly and try to twist the good times that roll around at the end of the year into scams that capitalize on your good intentions. As you can see, it’s not too tough to spot them for what they are if you pause and take a moment to scrutinize those emails, offers, and sales. And that’s the thing with the holidays. We can all feel pinched for time at some point or other during this stretch. Look out for their pressure tactics and seemingly clever ways of using social engineering to rip you off. That way, you can spend the holidays focusing on what’s important—your friends and family.