• Yazılım-DA
• Engineering

Social Engineering

" Hacking a computer system can be difficult.

But deceiving a person is often much easier. "

This is where social engineering comes in. Today, many cyberattacks target human psychology more than complex software. Because even the strongest security systems can be rendered ineffective by a single password given to the wrong person.

Social engineering is a method of attack that aims to obtain information, access, or money by manipulating people's emotions such as trust, fear, curiosity, or the desire to help. These attacks are psychological, not technical. Therefore, they are often more difficult to detect.

The attacker aims to gain access to confidential information, infiltrate systems, or obtain money transfers by manipulating people. No matter how strong firewalls, antivirus software, or encrypted connections are, when an employee calls pretending to be a real authority, people believe them and give their passwords, rendering all precautions useless. Therefore, attackers exploit vulnerabilities in human psychology such as belief, helpfulness, and fear, rather than computer errors. For example, a fake "You've Won a Prize" notification, an "Emergency Help" message from a lost loved one, or scammers posing as police officers/prosecutors, all exploit our trust.

How Social Engineering Works

Social engineering attacks generally follow a step-by-step process. First, the attacker gathers information about the target individual or organization through social media, websites, or data breaches, then initiates interaction to establish trust. In this phase, the attacker may intrude on your privacy by role-playing. In the next stage, they persuade you to perform the required action (password entry, clicking a link, sending money, etc.). For example, according to Kaspersky research, the social engineering process generally consists of the following steps: information gathering - building trust - exploitation - disconnection. This process can occur face-to-face, by phone, or entirely through online channels. The important thing is for the attacker to create the impression that you are being cautious and to make you feel unsuspecting, thus prompting you to act.

Common Techniques and Methods Used

Social engineers can set a wide variety of traps. For example, in phishing attacks, you are sent fake emails bearing the company logo, prompting you to click on malicious links or enter your information. These fake emails often contain urgent subjects such as "Your Account Has Been Blocked" or "You Need to Update." In some attacks, similar phishing is done via SMS (smishing) or in-app messaging. Smartphones are particularly targeted. The scammer may redirect you to a fake banking page via a link in a fake notification sent to your mobile phone. In this way, your password or credit card information can be stolen.

Phishing: These are attacks that phish people through email or SMS. For example, fake emails are sent under the guise of updating customer information, directing you to a link that closely resembles the real bank website.

Vishing: Telephone scams. The scammer impersonates police, bank, or IT personnel and requests your account information or one-time codes. They deceive the victim by impersonating a phone number or bank logo.

Pretexting: A method of trying to gain trust by creating a suitable scenario. For example, they pretend to be an authorized person from an institution and ask for information or ask for help by saying they have started a new job. The aim is to exploit the other party's instinct to help you.

Baiting: Setting a trap with the promise of an attractive gift or reward. For example, they trick you with the promise of free software, music downloads, or winning a lottery. People's curiosity and greed are targeted here.

Physical Techniques: Physical methods such as shoulder surfing (looking at someone entering a password from behind), dumpster diving, and USB dropping are also used. For example, they might try to trick you into opening a USB drive by leaving you one.

Role-Playing and Impersonation: The attacker impersonates an employee's boss, IT support, or a banker. This allows the victim to follow instructions without question. In a real-life case at a bank in Türkiye, a total of 2.4 million TL was withdrawn from the accounts of 8 customers through a fake IT Security call.

Psychological Factors and Human Vulnerabilities

The success of social engineering attacks often relies on psychological vulnerabilities. Research shows that attackers actively exploit human tendencies such as overconfidence, submission to authority, and fear of loss. For example, a person who thinks, "They can't fool me," may make decisions without questioning when faced with an emergency. Scammers also trigger people's desire to help, their compassion, or their feelings of panic. According to experts at Garanti BBVA, in current cases, a person may react quickly and impulsively when they receive an urgent message that they believe comes from a close relative. Similarly, claims such as "You've won a prize" can lure people into a trap by exploiting their curiosity. It is also known that social engineers often try to gain trust by portraying themselves as well-dressed, sympathetic, and helpful. All these methods lower the victim's level of suspicion and make it difficult for them to make rational assessments. People act on instincts such as trusting others, rushing to help, or avoiding punishment, and attackers skillfully exploit these impulses.

Real-Life Examples

Social engineering attacks have targeted many institutions and individuals both in the world and in Türkiye. For example, in the aforementioned vishing attack targeting a bank employee, attackers managed to access customers' account information by impersonating authorized personnel. In another case, the email accounts of managers at an e-commerce company were impersonated, and an attempt was made to carry out fraudulent transfers totaling approximately 850,000 TL.

Similarly, the identity information of an employee at a logistics company was compromised after they clicked on a link in a fake shipping message sent to their mobile phone. In companies that switched to remote work during the pandemic, there has been a significant increase in phishing attacks via fake VPN invitations.

International examples show that some fraudsters exploit humanitarian crises. For instance, numerous people have been defrauded through fake donation websites created under the guise of aid campaigns.

Especially in recent years, cybercrime has increased significantly in Türkiye, and the majority of attacks target human vulnerabilities rather than technical systems. These cases clearly demonstrate how widespread, effective, and dangerous a threat social engineering is.

Protection Methods

To protect against social engineering attacks, both individuals and organizations need to take multiple precautions. First and foremost, awareness and training are essential. Scenario-based security training and phishing tests should be conducted at regular intervals. Research shows that with continuous and measurable training, the success rate of social engineering attacks can be reduced by more than half. Employees should be trained with real-time examples to create a firewall within the organization.

At the individual level, it is important to pay attention to some simple rules: Be cautious of information requests from strangers. No bank or government institution employee will ask you for passwords, one-time codes, or identification information. If you encounter such a situation, hang up the phone and verify the institution by calling its official number. As for links in emails and messages, always check the URL/address. It is necessary to check the certificate by clicking the lock icon in the browser or not click on the link in the email without seeing its real target. Never open attachments from unknown sources. Also, be careful not to share your personal data on social media; because cybercriminals can gather this data and use it for blackmail.

Technical measures should also not be overlooked. Enable two-factor authentication (2FA) on all your critical accounts. Keep your relevant software and antivirus programs up-to-date. On an organizational level, it's beneficial to use advanced email filters and domain name protection, and to implement SIEM/SOAR systems that monitor suspicious activity. Everyone within the organization should be encouraged to be familiar with security policies and to report suspicious activity through open communication.

Social engineering reveals an important truth to us: Security is not just a matter of technology; it is also a matter of human behavior.

Today, the biggest cyber threats target not computer systems, but human psychology. Therefore, awareness, education, and skeptical thinking are the strongest defense mechanisms.

Because sometimes the biggest security vulnerability is not a software bug, but the thought,

" Nothing will happen to me. "