Module 9 of StartCloud's Cyber Hygiene for Staff learning pathway, in five short units with a knowledge check: attacks that skip technology entirely, the fake IT support call and the remote access tool behind it, the confident stranger in a hi-vis vest, tailgating through a secure door, the urgent favour supposedly from the boss, and why verifying a request is never rudeness.
The Phone Call, the Visitor, and the Favour
Attacks that skip the technology entirely
Everything so far in this pathway has involved a screen. This module does not. Some of the most effective attacks on a business use no technology at all: a phone call, a visitor, a favour asked nicely. There is nothing for a spam filter to catch, because the only thing being exploited is a person having a normal day.
The professionals call it social engineering. It is a grand name for something very old, which is convincing someone to open a door for you rather than picking the lock yourself. Three levers do nearly all the work, and you will notice none of them are weaknesses.
Somebody is stuck, running late, locked out, carrying too much. The instinct to help is a good one and most workplaces run on it. An attacker's whole job is to arrive looking like a person who needs a small, reasonable hand.
The IT department, head office, a director, a contractor sent by the building manager. Titles do a lot of quiet work. Most of us will not challenge a confident person who says they belong here, because being wrong about it feels worse than being right.
A meeting starting in two minutes, a system about to go down, a truck waiting outside. Urgency is not a side effect here, it is the whole design. Checking takes a minute, so they make sure you feel you do not have one.
Read that list again. Helpful, respectful, willing to get things done quickly. Those are the traits that make someone good to work with, and they are exactly what is being borrowed. Nobody gets caught out here because they are foolish. They get caught out because they are decent, and because a stranger counted on it.