{"id":95058,"date":"2025-07-21T09:44:49","date_gmt":"2025-07-21T13:44:49","guid":{"rendered":"https:\/\/www.rbcroyalbank.com\/en-ca\/?post_type=rbc_my_money_matter&p=95058"},"modified":"2025-10-02T14:29:47","modified_gmt":"2025-10-02T18:29:47","slug":"social-engineering-the-human-side-of-modern-scams","status":"publish","type":"rbc_my_money_matter","link":"https:\/\/www.rbcroyalbank.com\/en-ca\/my-money-matters\/money-academy\/cyber-security\/understanding-cyber-security\/social-engineering-the-human-side-of-modern-scams\/","title":{"rendered":"Social Engineering: The Human Side of Modern Scams"},"content":{"rendered":"\n
\n
<\/div>\n<\/section>\n\n\n\n

Unlike many cyberattacks that focus on breaking through technical defenses, social engineering works by manipulating human behaviour \u2013 scammers gain trust, exploit vulnerabilities or create anxiety, fear or delight in people to gain access to systems and data.<\/p>\n\n\n\n

Incredibly common and getting more sophisticated every year, social engineering forms the foundation of many scams \u2013 in fact, it\u2019s been reported that 98% of cyberattacks rely on social engineering at some stage.<\/a><\/p>\n\n\n\n

Why social engineering is so common<\/h2>\n\n\n\n

Social engineering is a common tactic because it works. Human error is predictable \u2013 scammers know that people can be tricked, and they know how to take advantage of their sensitivities. It\u2019s also low cost \u2013 it\u2019s much cheaper and faster for criminals to manipulate people than it is to try to break through layers of technical security. Carrying out social engineering attacks is also getting easier, as AI-generated voices, videos and messages allow scammers to create convincing material that can fool their targets.<\/p>\n\n\n\n

Types of social engineering attacks<\/h2>\n\n\n\n

There are many different types of social engineering methods, each with their own strength and specialty. Here\u2019s a rundown of some of the most common.<\/p>\n\n\n\n

Phishing<\/h3>\n\n\n\n

Phishing is the most common way of carrying out a social engineering scheme \u2013 90% of all attacks<\/a> start with a phishing email.<\/p>\n\n\n\n

In a phishing attempt, a cybercriminal will craft a convincing email posing as a reputable organization such as a bank, government or other trusted business. A typical phishing email will claim a data breach, contest or account issue and try to trick you into clicking a link to resolve the problem or take advantage of a prize. That link will lead to a fake website (that looks authentic), where you\u2019ll be asked to enter your personal information such as a credit card number, account number, password, date of birth and\/or driver\u2019s license.<\/p>\n\n\n\n

Spear phishing<\/h3>\n\n\n\n

While phishing is generally a \u201cbulk\u201d activity, where cyber criminals attack at random, spear phishing occurs when a fraudster specifically targets an individual or organization to gain specific sensitive information.<\/p>\n\n\n\n

Smishing<\/h3>\n\n\n\n

Smishing \u2013 or SMS phishing \u2013 uses text messages to trick people into downloading malware or sharing information. Given that SMS open rates<\/a> are upwards of 98% (compared to the 26.8% open rate for emails) , it is an increasingly popular way to attempt a social engineering attack.<\/p>\n\n\n\n

ClickFix<\/h3>\n\n\n\n

A new technique that was first seen in the spring of 2024, ClickFix is an attempt to execute a malicious command on a target\u2019s computer. The attack normally begins with a pop-up window that alerts the user of a technical problem. To fix it, they need to perform a few simple steps, which involve clicking a button or copying a line of code and pasting it into the system\u2019s \u201cRun\u201d application. Once that\u2019s done, malware is downloaded and installed onto the computer \u2013 ultimately infecting the device and potentially a whole network.<\/p>\n\n\n\n

Common \u201cproblems\u201d include:<\/p>\n\n\n\n