/digitaldrive/images/Digital_Drive_logo.png){kind=logo}
Digital Drive
IT Solutions
How cybercriminals manipulate trust, emotions, everyday decisions, and how to protect yourself.
Imagine your phone rings.
The person on the other end introduces themselves as a representative from your bank's fraud department.
They explain that suspicious activity has been detected on your account and that someone may be trying to steal your money.
They know your name. They sound professional. They seem genuinely concerned.
They tell you that your account needs to be secured immediately.
All you have to do is follow a few instructions.
Everything sounds reasonable.
There's just one problem.
The person calling might not work for your bank at all.
And by the time you realize what's happening, you may have helped them accomplish exactly what they wanted.
Welcome to the world of social engineering, where the target isn't necessarily your computer.
It's your decision-making process.
Social engineering is the use of deception and psychological manipulation to convince someone to reveal information, provide access, send money, or perform an action they otherwise wouldn't.
Instead of breaking through a computer's security, an attacker may try to convince the person using it to open the door.
Think about it.
You could have a fully updated computer, strong passwords, antivirus software, a firewall, and multi-factor authentication.
Those protections are important.
But what happens if someone convinces you to give them your password, approve their login request, or install software that gives them remote access?
The attacker may never need to defeat your security controls directly.
They convince you to work around them.
And this isn't a new idea.
Confidence tricks, impersonation, deception, and manipulation have existed for centuries.
Technology simply gives attackers more ways to reach people, gather information, and make their stories believable.
Social engineering can happen through an email, text message, phone call, social media conversation, video meeting, or even a face-to-face interaction.
If you've read our article on How to Spot Phishing, you've already encountered one form of social engineering.
But phishing is only part of the picture.
To understand the bigger threat, we need to understand how people are persuaded to trust something they shouldn't.
Most of us make countless decisions every day without thoroughly investigating every detail.
We recognize familiar names. We respond to authority. We help people in trouble. We trust established relationships. We sometimes act quickly because we're busy.
These are perfectly normal human behaviours.
Social engineers deliberately exploit them.
We're accustomed to following instructions from people in positions of authority.
Police officers, managers, government representatives, financial institutions, and technical support personnel all have legitimate reasons to request certain actions.
An attacker can exploit that expectation simply by pretending to hold one of those positions.
They might introduce themselves as your bank's fraud investigator, a government official, or your company's IT administrator.
A confident voice, professional language, or official-looking identification can make the deception more convincing.
The warning sign: Someone uses their claimed authority as a reason you shouldn't question the request.
How to protect yourself: Verify their identity through an independent, trusted channel before taking any sensitive action.
Imagine receiving this message:
"Someone is trying to withdraw money from your account. If you don't act within ten minutes, we can't guarantee your funds will be protected."
Now you're worried.
You may be less concerned about verifying the caller's identity than stopping the supposed threat.
That's exactly what the attacker wants.
Fear creates pressure. Urgency reduces the opportunity to think.
Sometimes the attacker offers to solve the very problem they've invented.
The warning sign: You're being pushed to act before you can independently verify what's happening.
How to protect yourself: Slow the interaction down. Contact the organization through a trusted method and investigate the claim yourself.
A genuine emergency doesn't automatically make an unverified instruction trustworthy.
Not every attack relies on fear.
Some appeal to curiosity, excitement, or the possibility of a reward.
"You've won a prize!"
"Someone uploaded a picture of you."
"Click here to see who viewed your profile."
The attacker wants you to focus on the reward rather than the action required to obtain it.
That action might involve opening a malicious website, entering your credentials, downloading software, or paying a supposed processing fee.
How to protect yourself: Treat unexpected offers and intriguing messages as unverified claims, especially when they require you to provide information, money, or access.
Imagine receiving a message from someone claiming to be a family member.
They've lost their phone, they're stranded, and they urgently need money.
They ask you not to tell anyone because they're embarrassed.
Your immediate reaction might be to help.
That's what makes this form of manipulation particularly effective.
The attacker isn't exploiting selfishness.
They're exploiting compassion.
Other attacks build familiarity more slowly, through conversations, shared interests, professional connections, or romantic relationships.
Over time, the relationship itself becomes the reason a request seems trustworthy.
How to protect yourself: Verify unusual requests using contact information you've already established, particularly when money or sensitive information is involved.
Attackers may also use statements such as:
"Your manager already approved this."
"Everyone else on your team has completed the process."
"I helped you earlier, so I need you to do this for me."
These statements create pressure to cooperate, avoid conflict, or return a favour.
Some attackers will even become angry or threatening when questioned.
That reaction is itself a reason to stop and verify.
Here's the important part:
A social engineering attempt may combine several of these techniques.
A fake bank representative could use authority, fear, urgency, and reassurance in the same conversation.
The more convincing the story, the easier it becomes to overlook what you're actually being asked to do.
Let's return to our fake bank representative.
The attack might unfold like this.
The attacker gathers information.
Your name, telephone number, employer, social media activity, and other publicly available details may help them build a believable story.
Sometimes this information comes from previous data breaches.
The attacker doesn't need to know everything about you.
Just enough to sound credible.
They call you, send a message, or approach you through another channel.
They claim to be someone you would normally trust.
In our example, a bank fraud investigator.
They might even manipulate caller ID so the call appears to come from a legitimate organization.
The caller explains that your money is in danger.
They provide convincing details and emphasize that immediate action is necessary.
They may reassure you that they're there to help.
The goal is to make the fabricated situation feel real.
Now comes the actual objective.
Perhaps they ask for a verification code sent to your phone.
Maybe they instruct you to transfer money into a supposedly secure account.
Or they direct you to a website where you're asked to enter your banking credentials.
The request is presented as a necessary step toward solving the problem.
But the requested action is the attack.
If you comply, the attacker may gain access to an account, steal money, obtain sensitive information, or use your identity to target someone else.
Not every attack follows this exact sequence.
Some are completed in minutes. Others involve conversations lasting weeks or months.
But the underlying mechanism is remarkably consistent:
Create a believable situation. Establish trust. Influence a decision. Obtain something valuable.
Understanding that process is more useful than memorizing a hundred different scams.
Social engineering isn't limited to suspicious emails.
Here are several ways it can appear in everyday life.
These are related techniques delivered through different channels.
Phishing uses deceptive messages, usually emails, to encourage someone to reveal information or perform an unsafe action.
Smishing is phishing through text messages.
Vishing uses voice calls.
A text claiming your package cannot be delivered, an email requesting an account reset, or a caller pretending to represent your bank may all use the same psychological techniques.
For a detailed explanation of suspicious messages and links, see our How to Spot Phishing article.
Pretexting involves creating a false scenario that gives the attacker an apparent reason to contact you.
For example, someone calls a business pretending to be from its software provider.
They claim they're updating customer records and need an employee to confirm login information.
The story gives the request a seemingly legitimate purpose.
Protection: Independently verify the person's identity and authority before providing information or access.
Baiting uses an attractive offer to encourage an unsafe action.
It could be a supposedly free program, an unexpected prize, or a USB drive left somewhere people might find it.
The attacker hopes curiosity or the apparent benefit will overcome caution.
Protection: Don't connect unknown storage devices or install unverified software. Investigate unexpected offers through legitimate sources.
You receive a call or see a pop-up warning that your computer is infected.
A helpful technician offers to fix it.
They ask you to install remote-access software or give them control of your computer.
Once connected, they may access information, alter settings, install malicious software, or convince you to pay unnecessary charges.
Protection: Never grant remote access simply because an unexpected caller or website tells you there's a problem. Contact a trusted technician independently.
Imagine you operate a small business.
You regularly pay invoices from a supplier.
One day, you receive an email explaining that the supplier has changed banks and future payments should go to a new account.
The message looks legitimate.
It might even come from a compromised account belonging to someone you genuinely do business with.
If you follow the instructions without verification, you could send money directly to the attacker.
Protection: Verify payment changes using a previously established telephone number or another independent channel. For significant payments, require a second approval.
Not every attacker operates through a screen.
Someone wearing a uniform, carrying equipment, or claiming to be a contractor may attempt to enter a restricted building.
They might ask an employee to hold a secure door open because they've forgotten their access card.
This is commonly called tailgating.
Other attackers might impersonate delivery personnel, maintenance workers, or visitors.
Protection: Follow normal visitor identification and access procedures, regardless of how legitimate someone appears.
You can be polite without bypassing security.
Some attackers build personal or professional relationships over time.
They may present themselves as romantic partners, business contacts, investment advisers, or people who share your interests.
Once trust has been established, they introduce requests for money, account access, personal information, or investments.
The relationship is used to make questioning the request feel unnecessary—or even disloyal.
Protection: Independently verify financial opportunities, avoid transferring money to unverified recipients, and discuss major decisions with someone you trust.
A relationship, however convincing, isn't proof that a financial request is legitimate.
Attackers may persuade someone to provide a login code, approve an unexpected sign-in notification, reset an account, or authorize an unfamiliar application.
For example, repeated MFA notifications might eventually convince a frustrated user to approve one just to make them stop.
Or someone claiming to be from IT might tell you to read a verification code aloud.
Protection: Never approve an unexpected login request or share authentication codes on someone else's instructions.
If you receive repeated unexplained approval requests, deny them and investigate the account.
You can learn more in our article on MFA Explained.
Remember when poorly written scam emails were easy to recognize?
Bad spelling, awkward grammar, and strange formatting were common warning signs.
Those warning signs haven't disappeared, but they're no longer dependable.
Artificial intelligence can help attackers produce professional-looking communications, tailor messages to individuals, and imitate familiar writing styles.
It can also be used to generate synthetic audio and video.
Imagine receiving a phone call that sounds exactly like your daughter, your employer, or a close friend.
The voice is familiar.
The emotional urgency feels real.
But the voice may have been artificially generated or manipulated.
This is commonly known as voice cloning.
Similarly, convincing video or audio generated using AI is often called a deepfake.
You don't have to understand how these technologies work to understand the risk.
A familiar voice is not proof of identity.
Neither is a familiar face, a polished email, or a realistic-looking video.
And attackers don't always need AI.
An actual account belonging to someone you know might have been compromised, allowing fraudulent messages to arrive inside a legitimate conversation.
Don't make identity decisions based entirely on appearance, voice, or writing style.
If a loved one makes an unusual financial request, call them using their normal number.
If your manager asks you to send money or release confidential information, verify using an established company communication channel.
For families, consider agreeing in advance on how to confirm unusual emergency requests.
For businesses, use documented approval procedures that cannot be bypassed simply because a voice or video looks convincing.
The solution isn't becoming an expert at detecting AI-generated content.
It's developing verification habits that work even when a fake is impossible to recognize.
One of the most convincing things an attacker can do is demonstrate personal knowledge.
They might know your full name, where you work, your family members, or that you've recently been travelling.
That information can make the interaction feel legitimate.
But knowing something about you doesn't establish who they are.
Information may be gathered from social media, business websites, public records, previous data breaches, and other accessible sources.
Sometimes the attacker has simply obtained information that was originally shared for an entirely legitimate reason.
You've probably seen them:
"What was the name of your first pet?"
"What was your first car?"
"What street did you grow up on?"
"What's your mother's maiden name?"
"What was your childhood nickname?"
"Share your birthday and favourite colour!"
They look like harmless fun, and friends often repost them without a second thought.
But think about what you're actually sharing.
Many of these questions resemble the security questions traditionally used to verify someone's identity or recover access to an account.
Others reveal personal details that can help an attacker build a convincing profile of you, guess passwords, or impersonate someone you know.
Not every questionnaire is deliberately created by a scammer, but that doesn't make the information harmless once it's publicly available.
And changing your privacy settings doesn't necessarily prevent your answers from being copied, shared, or exposed later.
The safest approach? Don't participate in public questionnaires that ask for personal history, family details, birthdays, or information connected to your identity.
Your first pet's name might be a fond memory.
It doesn't need to become part of a stranger's research project.
Review the personal details visible on your public social media profiles.
Consider whether your posts reveal travel plans, family relationships, contact information, or other details that could make impersonation easier.
For businesses, review what employee and organizational information is publicly available.
There's no need to disappear from the internet.
Just understand that publicly accessible information can be used to build convincing stories.
Personal knowledge is not proof of identity.
Social engineering can take many forms, but certain patterns should make you stop and examine a request more carefully.
Be particularly cautious when someone:
Requests money, personal information, credentials, authentication codes, or access unexpectedly.
Creates pressure to act immediately.
Claims an emergency but discourages independent verification.
Asks you to bypass normal company or security procedures.
Insists that you keep the request secret.
Asks you to install software or grant remote access.
Changes familiar payment instructions without a verified explanation.
Claims to hold authority but becomes hostile when questioned.
Uses emotional pressure, threats, rewards, or embarrassment to influence your decision.
Provides contact details or a website and insists you use only those to verify the request.
But there's an important limitation to this list.
Not every social engineering attempt contains an obvious warning sign.
Some attackers are patient, polite, knowledgeable, and convincing.
They may ask for small, seemingly harmless actions before making a more significant request.
That's why the best protection isn't simply learning what suspicious people sound like.
It's establishing good habits for evaluating requests.
If there's one lesson to take away from this article, it's this:
STOP. QUESTION. VERIFY.
Three simple actions can interrupt many social engineering attempts before they succeed.
When someone unexpectedly asks for money, information, or access, don't assume you have to respond immediately.
Take a moment.
You are allowed to end the call, close the message, walk away, or ask for time to investigate.
Someone else's urgency doesn't automatically create an obligation for you.
Ask yourself:
Who is asking?
Do I know who this person actually is, or am I relying on what they're telling me?
What do they want?
Am I being asked to reveal information, open a file, send money, approve a login, install software, or grant access?
Why do they want it?
Does the request make sense given our relationship and normal procedures?
Why now?
Is there a legitimate reason for urgency, or am I being pressured to act without thinking?
What could happen if they're not who they claim to be?
This last question is especially important.
The greater the potential consequences, the stronger the verification should be.
This is the most important step.
Don't verify a suspicious request using only the contact information supplied by the person making it.
If someone claims to be from your bank, use the number on your bank card or official banking application.
If an email claims to be from a service provider, access the provider through an established bookmark or official application.
If a coworker or manager requests an unusual action, confirm it through a trusted internal communication method.
If a supplier changes banking information, contact them using a telephone number already on file.
And remember that search results can contain misleading advertisements or fraudulent contact information.
Using the first telephone number you find online isn't always independent verification.
The objective is simple:
Confirm the request through a source the potential attacker does not control.
Understanding the techniques is useful.
Building everyday protective habits is better.
Use strong, unique passwords for important accounts.
A reputable password manager can help you create and manage them.
Enable multi-factor authentication wherever possible.
When supported, passkeys or physical security keys can provide stronger protection against credential phishing.
And never share unexpected authentication codes or approve sign-in requests you didn't initiate.
Keep your operating system, browser, and applications updated.
Use reputable security protection.
Avoid installing software from unfamiliar sources, especially when directed by an unsolicited caller.
Never assume a pop-up claiming your computer is infected is telling the truth.
Treat unexpected requests involving transfers, gift cards, cryptocurrency, new payment destinations, or urgent investments with particular caution.
Verify financial instructions independently.
Don't rely on a claimed emergency as proof that a payment is necessary.
Be thoughtful about what you publish publicly.
Avoid sharing sensitive identity information unless you've verified who needs it and why.
And remember that a legitimate organization having a reason to contact you doesn't mean every person claiming to represent it is legitimate.
Have conversations with family members about unexpected requests, emergencies, and impersonation.
Agree on a way to confirm unusual requests.
Encourage everyone to ask questions without embarrassment.
Someone who feels comfortable discussing a suspicious interaction is more likely to get help before a situation becomes worse.
For small businesses, social engineering can lead to financial loss, unauthorized access, information exposure, and operational disruption.
An attacker might impersonate an owner, supplier, employee, customer, or IT provider.
And a business doesn't need hundreds of employees to be a target.
In fact, smaller organizations may rely on informal arrangements and personal trust instead of established procedures.
That can make certain attacks easier.
Changes to supplier banking information should always be verified using established contact information.
Consider requiring a second person to approve unusual or high-value transactions.
Never treat an email alone as sufficient authorization for a significant payment change.
Define how employees and IT providers request account changes, password resets, and access permissions.
Require identity verification before sensitive changes are made.
Don't allow someone claiming to be an executive or technician to bypass the process.
Employees and contractors should only have access to the information and systems needed for their responsibilities.
This is the principle of Least Privilege.
If an account becomes compromised, limiting its permissions can reduce the potential damage.
Employees should know they're allowed to verify unusual requests, even when those requests appear to come from management.
A manager who genuinely needs something done should support an established verification procedure.
If employees are afraid of getting in trouble for asking questions, attackers can exploit that fear.
Security awareness training doesn't need to be complicated.
Discuss actual situations employees might encounter.
A supplier changes banking information.
Someone claiming to be IT requests a password reset.
A familiar contact sends an unusual file.
A visitor asks to be let through a secured entrance.
Show employees how to respond, not just what to watch for.
Employees need to know who to contact when something seems suspicious.
Reporting should be encouraged, even when someone has already followed part of a fraudulent request.
Early reporting can help prevent further damage.
A good security process should protect people even when an attacker is extremely convincing.
That's far more dependable than expecting every employee to recognize every deception.
You don't need proof of a scam before taking precautions.
If a conversation or request raises concerns:
Stop the interaction.
Don't provide additional information, access, or money.
Verify independently.
Contact the legitimate person or organization using an established method.
Preserve relevant information.
Keep suspicious messages, transaction details, and other evidence where appropriate. Avoid interacting further with suspicious links or files simply to investigate them.
Report the attempt.
Use your employer's reporting process, the relevant service provider's reporting tools, or appropriate fraud-reporting services.
Warn others when necessary.
If an attacker is impersonating you or targeting your workplace, timely notification may help protect additional people.
For in-person situations, prioritize safety and established access procedures rather than confronting someone aggressively.
And remember:
You do not have to continue a conversation simply because someone insists that you should.
First, what happens next depends on what information or access was provided.
Receiving a fraudulent call isn't the same as sharing an account password.
Clicking a link doesn't automatically mean your computer has been compromised.
But if you've performed an action that might have exposed money, information, or access, respond promptly.
Change it immediately through the legitimate website or application.
Change passwords on other accounts if you reused the same one.
Review recent login activity, sign out suspicious sessions, and enable or strengthen MFA.
Secure the affected account immediately.
Review account activity and authorized devices, revoke unfamiliar sessions or application access where possible, and contact the service provider or your IT administrator if needed.
Contact your bank or payment provider immediately.
Explain what happened and ask whether the transaction can be stopped or recovered.
Time can matter.
Preserve relevant transaction details and communications for reporting.
End the remote session.
If you suspect the device has been compromised, disconnect it from the network and obtain assistance from a trusted technical professional.
Avoid entering additional passwords or financial information on the affected computer until it has been assessed.
A security scan may help, but it cannot guarantee that all unauthorized activity or software has been found.
Contact affected institutions and monitor your financial accounts for suspicious activity.
Depending on what information was exposed, you may also need to contact relevant government agencies and credit bureaus to protect yourself against identity theft and fraud.
In Canada: Contact Equifax Canada or TransUnion Canada to discuss fraud alerts and monitoring your credit reports. You can also report identity fraud to the Canadian Anti-Fraud Centre.
In the United States: Visit IdentityTheft.gov for a personalized identity theft recovery plan. Contact the three major credit bureaus—Equifax, Experian, and TransUnion—to request fraud alerts or credit freezes when appropriate.
Act quickly. The sooner you secure affected accounts and report potential identity theft, the better your chances of limiting further damage.
Notify your IT support, manager, or designated incident-response contact promptly.
Don't attempt to conceal the incident or quietly fix everything yourself.
Your organization may need to secure accounts, investigate transactions, preserve evidence, and warn others.
After a fraud incident, someone may contact you claiming they can recover stolen funds for a fee.
That person could be another scammer.
Verify recovery-related services independently before providing further information or money.
The objective is to recognize what happened, contain the damage, recover where possible, and prevent the attacker from doing more harm.
12. Where to Report Social Engineering, Fraud, and Cybercrime
Reporting a suspected scam helps authorities identify threats, investigate criminal activity, and warn others.
You don't have to lose money to report an attempted fraud.
Whether you're in Canada or the United States, there are official organizations that accept reports of suspected fraud and cybercrime.
Canadian Anti-Fraud Centre (CAFC)
The CAFC collects reports of fraud and cybercrime, including phishing, impersonation, financial scams, and identity fraud.
You can report an attempt even if you haven't suffered a financial loss.
Report Fraud and Cybercrime — Canada
Online reporting: https://reportcyberandfraud.canada.ca/
Telephone: 1-888-495-8501
Local Police
If you've been a victim of fraud or cybercrime, contact your local police service. The CAFC collects and shares intelligence, while police investigate criminal complaints.
FBI — Internet Crime Complaint Center (IC3)
The FBI's IC3 is a primary reporting destination for internet-enabled crime, including online scams, account compromise, business email compromise, ransomware, and financial fraud.
Individuals and businesses can submit reports.
Report Internet Crime — FBI IC3
Federal Trade Commission (FTC)
The FTC accepts reports of suspected scams, phishing, impersonation, fraudulent businesses, and other consumer fraud.
You can report suspicious activity even if you haven't lost money.
IdentityTheft.gov — FTC
If someone has stolen or misused your personal information, this service helps you report identity theft and develop a recovery plan based on your circumstances.
Report Identity Theft and Get Recovery Guidance
Cybersecurity and Infrastructure Security Agency (CISA)
U.S. businesses and organizations can also report cybersecurity incidents, phishing activity, and suspected system compromises to CISA.
CISA — Report a Cybersecurity Incident
Telephone: 1-888-282-0870
Email: [email protected]
In addition to the national reporting organizations, there are simple ways to report suspicious messages.
Suspicious emails: Use your email provider's built-in Report Phishing feature where available.
You can also forward phishing emails to the Anti-Phishing Working Group (APWG) at:
Suspicious text messages: In Canada and the United States, many mobile providers allow you to forward suspicious text messages to:
7726 (SPAM)
Availability and reporting procedures can vary by provider.
Workplace incidents: Report suspicious messages or interactions through your organization's established IT or security reporting process.
Don't wait for a response from a reporting agency before taking protective action.
Contact your bank or payment provider immediately if money was transferred or banking information was exposed.
Secure affected accounts if passwords, authentication codes, or access were shared.
Notify your employer or IT support promptly if business systems or information may be affected.
Preserve relevant evidence, including messages, transaction records, and contact details.
Contact local police if you've been the victim of a crime.
Remember: Reporting helps authorities identify and investigate threats, but it does not guarantee the recovery of stolen money or information.
The sooner you respond, the better the opportunity to limit further damage.
You don't need to be a cybersecurity expert to make a difference. Recognizing and reporting an attempted scam can help protect someone else from becoming the next target.
Here's the bigger picture.
Social engineering works because attackers understand something fundamental about human behaviour.
We trust people.
We want to help.
We respond when someone is frightened.
We cooperate with authority.
We sometimes make decisions quickly because we have a dozen other things demanding our attention.
Those qualities are part of how we function as individuals, families, and communities.
The attacker attempts to turn them into opportunities.
But the answer isn't to become suspicious of everyone or afraid of every interaction.
It's to understand the difference between trusting someone and verifying a request.
You can be helpful without giving an unknown caller access to your computer.
You can care about a family member without sending money before confirming they're safe.
You can respect your manager while verifying an unusual payment instruction.
And you can maintain good relationships with customers, colleagues, and suppliers while following established security procedures.
This is where social engineering connects to two important cybersecurity principles.
Zero Trust: Don't automatically grant trust or access based solely on someone's claimed identity, familiar appearance, or location.
Least Privilege: Give people and systems only the information and access they actually need.
Neither principle requires abandoning trust.
Both help ensure that trust is supported by appropriate verification and sensible boundaries.
Technology plays a role, too.
Firewalls, security updates, antivirus protection, spam filtering, MFA, and access controls all help reduce risk.
But technical tools cannot independently evaluate every conversation, emotional appeal, or business decision.
That's why effective security needs more than software.
It needs processes people can understand, question, and follow.
A social engineering attack doesn't always look like a hacker at a keyboard.
Sometimes it looks like a helpful technician.
A concerned bank employee.
An urgent message from your boss.
A family member in trouble.
Or a friendly stranger who seems to know an awful lot about you.
The attacker wants to influence what you believe, how you feel, and what you do next.
You don't need to memorize every scam or become an expert in psychology to protect yourself.
You need to recognize when someone is asking you to make a decision that could affect your money, information, security, or access.
And remember that the more important the decision, the more important it is to verify the request independently.
STOP. QUESTION. VERIFY.
Because sometimes the most effective way to hack a computer...
...is to never touch the computer at all.
Digital Drive IT Solutions
Demystifying technology so people can make better decisions.