Social Engineering Attacks: Understanding Human Manipulation and the Growing Role of Artificial Intelligence

Introduction

When we think of cyber security we always think of hacking, viruses and exploits. However, not all cyber-attacks require advanced technical knowledge. Sometimes all that is required is to trick someone. Social engineering is when cyber criminals will attempt to trick people into giving away confidential information, sending money or giving access to their accounts. They often use our feelings to trick us including; fear, trust, curiosity and urgency. With our increasing reliance on digital services we are seeing increasingly sophisticated social engineering attacks. From fake calls from our bank to digital arrests criminals are finding new ways to trick us. With the increasing misuse of AI we are also seeing more fraudulent communication which can be very hard to spot.

Social Engineering Attacks

Social engineering attacks work by manipulating people into giving away sensitive information or carrying out activities that put them at risk. They work by exploiting human behaviour rather than technical aspects. The attack will frequently begin with an elaborate story. The fraudster could be posing as a member of your bank, IT support or government official. Once they have gained your trust, they will try and gain information from you or get you to do something. This can be very dangerous as it can get past even the strongest security systems. An organisation with high level cyber security could still leave themselves open to risk if an employee falls for the scam and gives away their login details or approves an unauthorised request.

Common types of Social Engineering Attacks:

• Phishing – Criminals will send false emails/messages pretending to be from legitimate sources. They are often filled with malicious links or asking for your personal information.
• Spear Phishing – This is a targeted phishing attack where personal/professional information is used so it appears to be genuine.
• Vishing – Voice phishing is where criminals will call you pretending to be bank employees, customer services or government.
• Smishing – Criminals will send you misleading texts trying to trick you into clicking on suspicious links or giving away your OTP and financial information.
• Pretexting – Attackers will create fake identities or situations to gain your trust. This could be a fraudster pretending to be a member of staff within IT asking for your login details
• All of these are trying to trick individuals into making decisions which could put them at risk.

Digital Arrest Scams

A worrying example of social engineering is the digital arrest scam. This scam uses fear, and a lot of manipulation of authority.Fraudsters will contact individuals and pretend to be from the police force, investigating agency or government officials. They may sometimes ask you to stay on the video call and not to contact your family.The term Digital Arrest is misleading as there is no process in Indian law that allows someone to be arrested via video call.These scams show how criminals can use peoples fear of legal repercussions. If you believe you are speaking to law enforcers you may do what they ask.

Why digital arrest scams work

There are a number of factors that make this scam successful;The criminals will pose as a government authority this causes a sense of fear. They threaten legal consequences. They will also make the victim feel isolated as they won’t tell them to seek assistance.This means they are more likely to pay money, give personal information and follow instructions.This shows that some cyber crimes can be carried out with no technical hacking. If they can create a convincing story then it can cause serious financial and emotional issues.

Legal Consequences Under Indian Cyber Laws:

There are many legal provisions that can be enforced against Social Engineering Attacks in India.

• Section 66C of the Information Technology Act, 2000: Covers the offense of identity theft and misusing another individual’s password, electronic signature or unique identifier.
• Section 66D: Covers the offense of cheating by impersonating through the use of computer resources or communication devices. This is very relevant in cases where fraudsters are impersonating officials.
• Sections 318 & 319 of the Bharatiya Nyaya Sanhita, 2023: Covers the offense of cheating and cheating by impersonating.

These crimes can be difficult to investigate as criminals often will be using fake identities and on an international scale. They also frequently switch communication methods making it hard to know who they are and recover any stolen money. Collaboration from Law Enforcement Agencies, Financial Institutions, Technology and Cyber Security is required to combat these crimes.

How Social Engineering Attacks are being impacted by Artificial Intelligence.

There are new issues that have come into play in terms of cyber security with artificial intelligence. Whilst there are many benefits to using AI, criminals can use AI to create more realistic social engineering attacks.

AI generated Phishing:Phishing emails used to be easy to spot due to grammar, spelling and language errors. However, using generative AI criminals can now create highly realistic and personal phishing emails within seconds.Using open source data, criminals can create messages tailored to the individual making it harder to detect fraud.

Deepfake & Voice Cloning:Criminals can use AI tools to clone voices and create realistic videos This can cause issues as criminals can impersonate family members, company executives and public officials. For example receiving a phone call from someone that sounds like a family member asking for money urgently.In Digital Arrests criminals can use AI voices and edited videos to create more realistic fake law enforcement officials. However not all digital arrests will be created using AI.

Mass Creation:AI can be used to help criminals create masses of fraudulent messages. They can be targeted to more people due to less preparation required.The main issue of using AI is it makes deception easier.

Conclusion

Social engineering is still an issue when it comes to cyber security. As it targets peoples decision making rather than exploiting technology. Whether it be phishing emails, fraudulent phone calls or digital arrests criminals will look to exploit your trust, fear and urgency.

Using AI can cause further risks. Creating messages using AI, voice cloning and deep fake videos can all help criminals to impersonate people in a more realistic way. By using automation criminals can target a larger audience with fraudulent messages. The Digital Arrests show how much damage can be done by psychologically manipulating people. Using AI can create more advanced deceptions.

References

• Cybersecurity and Infrastructure Security Agency (CISA), Phishing Guidance: Stopping the Attack Cycle at Phase One (2023), Official CISA Report
• Matthew Kosinski, 'What Is Spear Phishing?' (IBM Think), Official IBM Article
• Cybersecurity and Infrastructure Security Agency (CISA), Phishing: General Security Postcard, Official CISA Guide
• Matthew Kosinski, 'What Is Smishing (SMS Phishing)?' (IBM Think), Official IBM Article

‍