Social Engineering

We’ve been getting a spate of phone calls at home.

The conversation goes something like this:

Me: Hello

Them: Can I speak with Mr. Smith? (name changed, but it isn’t mine)

Me: I’m sorry Mr. Smith hasn’t lived here since 2003.

Them: Is that Windy Way? (also changed)

Me: I’m not prepared to confirm that ….

We then bat back and forth a bit where they are trying to get some details about my address confirmed and I just stick to my mantra of “Mr. Smith hasn’t lived here since 2003″ and / or “I’m not prepared to confirm that”. At which point they have always got nasty or downright rude and it always ends with me hanging up as they try every tactic they can to get me to confirm something. Typically a day or so goes past before I get another one.

This seemingly innocuous approach to getting details is the old ‘social engineering‘ approach – whereby you use a fact (whether true or not) to gather accurate details of your target. The end game being that your or your company’s security gets compromised in some way.

The whole saga reminded me to have another chat with my children.

I’ve covered online dangers many a time with my children but for some reason had overlooked the more obvious direct approach.

My end advice to them was ultimately very simple:

If you don’t know the person then tell them nothing.

And always refer them to mum or dad.

Turns out our regular caller is a debt collection agency based in Scotland and they are known for their rude strong arm tactics in trying to get information so that they can pin a debt on you.

Reminds me that all the dangers aren’t online and we do well to remember that.

• have you any simple safety advice?
• have you fallen foul of social engineering?
• if so, what was the outcome?