Social Engineering: Phishing, Vishing and Impersonation

Social engineering attacks the person rather than the system. Phishing arrives in writing, vishing by voice, smishing by message, and impersonation is what all three do once they have arrived. Nothing is broken into. The person is asked and the person agrees. A secure system therefore does not help, and being careful is not the defence it sounds like.

The finding is not a kindness placed at the end of a lecture. The finding is the subject itself, and the working below supports it. One sentence is worth carrying away, and the finding holds now rather than after somebody has finished blaming themselves.

The ground the finding rests on is uncomfortable. Knowing about these calls does not prevent them. Ashok Bhosale knew such calls existed. Everybody knows such calls exist. The people who spend their working lives looking at them know it better than anybody and are taken anyway. Knowing operates on a different part of a person from the part these calls are addressed to. So the defence cannot be knowledge, and it is not carefulness either. The defence is one habit, set out below, and it works precisely because it asks nobody to judge anything at all.

What is social engineering actually attacking?

Social engineeringAttacking the person rather than the system. The person is asked, and the person agrees, so nothing has to be broken. is the plain name for a class of attack that never touches the machinery. There is no lock picked, no wall climbed, no cleverness applied to anything technical. Somebody speaks to a person, that person does something, and the doing is entirely voluntary in the sense that the person meant to do it. The system was never the target, so the system being sound is no defence.

The shape is easier to see in a building. Think about one for a moment. A building can have a strong door, a good lock, a bolt on the inside and a chain. All of that describes what happens if somebody tries to force the door. None of it describes what happens if somebody knocks, says something entirely reasonable through the door, and is let in by the person standing behind it. The door was not defeated. The door was opened. Every lock on it worked perfectly for the whole of that exchange.

An opened door is the whole architecture of what happened on 14 September, and it is why the household could not have found the failure by examining anything mechanical. The account behaved correctly. The transfer went where it was told to go. The record was written accurately. There was nothing wrong with the machinery, so a search through it afterwards would find nothing wrong. The only component that was acted upon was a person, and a person is the one component nobody publishes a security specification for.

The reversal of the usual instinct is worth sitting with. When money goes missing, the first question a household asks is what was broken. Here the honest answer is nothing, and that answer feels so unsatisfying that people reject it and go looking for a breakage anyway. There is none. There was a conversation, and the conversation did the work.

How many untrue things did Ashok Bhosale have to believe?

None. The answer is worth stating flatly before it is explained. The explanation is where people start negotiating with themselves.

Across the four minutes between the call connecting at 11:38 and the first transfer at 11:42, the beliefs count out as follows. Belief one: an institution might telephone a person about an account. True. They do. Belief two: a problem might arise with a recurring deposit. True. Problems arise with everything. Belief three: a caller who knows a person's name and the last four digits of an account probably has a legitimate reason to know them. True often enough that the opposite assumption would make ordinary life impossible. Belief four: a person who is calm, unhurried and correct about detail is unlikely to be lying. True as a general rule about human beings, and precisely because it is a general rule it can be borrowed.

Four beliefs, four of them reasonable, and Rs 18,000/- gone. No step in that sequence required credulity. No step required ignorance. There was no contradiction to find, so there was no moment at which a more suspicious person would have found one. A lie can be caught and a frame cannot, and that difference is one most people have never had explained to them.

The everyday version is worth feeling rather than merely reading. Somebody knocks at a door in a work shirt and says the water connection on this line is being checked, mentions the flat number, mentions that the tank was topped up on Tuesday, and asks for the meter cupboard to be opened. Every single thing said is true, checkable and unremarkable. The cupboard is opened. Nothing believed along the way was silly. The whole exchange rested on facts, and the facts were free to anybody who watched the building for a week.

What are the four channels it arrives through?

Three of the four names that follow describe a route in. The fourth describes what every route does once it is inside. The four are taken together because a household needs one list rather than two, and because these four words are the ones people actually meet: phishingSocial engineering that arrives in writing, whether that is an email, a letter, a form or a website the reader was sent to., vishingSocial engineering that arrives by voice, on a live telephone call, so that a real person is talking in real time., smishingSocial engineering that arrives by short message, so it waits on the device until it is looked at rather than demanding an answer at once. and impersonationOccupying a position of trust that belongs to somebody else, so that the trust attaching to the position transfers to whoever is standing in it..

The three routes differ only in what carries the words, and the words are not the mechanism. The three therefore belong together rather than as three separate subjects with three separate defences. Three defences, one for writing, one for voice and one for messages, are three things that all fail on the fourth day, when something arrives by a route that was never listed.

A useful way to hold it: the route decides how much can be said, how quickly an answer is expected, and what the thing can show. The route does not decide what is being done to the person. Impersonation is the same in all three cases, and it happens at the moment attention has been captured and a position of trust has been occupied.

What is Phishing, and what makes writing so effective?

Phishing is social engineering that arrives in writing. An email, a letter, a form, a website the reader was sent to and typed into. The written channel has one property that makes it the workhorse of the whole class: writing carries surface, and surface is cheap to copy while substance is not.

A written thing can look right in a way a person cannot. A written thing can have a heading, a reference number, a footer, a sentence in small print, a tone that matches every other formal document a household has received. All of that is appearance, and appearance is exactly the part that costs nothing to reproduce. Meanwhile the part that would actually settle who wrote it is not in the document at all and never was. Almost nobody has been told that plainly.

A printed wedding invitation makes the point. The card is heavy, the printing is good, the wording is formal, the address is right. None of that settles who had it printed. The card settles that somebody spent four hundred rupees at a press. Written financial material is the same object: the quality of the presentation is evidence about the effort, not about the sender, and the two get confused because in ordinary life effort and legitimacy usually travel together.

Phishing therefore borrows a reader's habits. A person has read hundreds of formal documents and has built a fast sense of what one looks like. The fast sense is useful, it is usually right, and it is the exact faculty the written channel is aimed at. Nobody in that sequence has been foolish. A pattern that works nine hundred times has been used a nine hundred and first time.

What is Vishing, and what does a voice do that writing cannot?

Vishing is social engineering that arrives by voice, on a live call, with a person on the other end responding in real time. Vishing is the channel the 14 September call used, and it has two properties that writing does not.

The first is that a voice adapts. A written thing has to anticipate every objection in advance and answer it in the text. A person can wait for the objection that actually comes and then answer that one, in the other party's words, at the other party's pace. Where there is hesitation, the voice can slow down. Where there is irritation, the voice can apologise. A live voice is not a document that talks; it is a conversation that adjusts, and adjusting is worth more than any amount of polish.

The second is that a voice occupies attention completely for as long as it is speaking. A call cannot be put down and returned to in twenty minutes the way an email can be left unread. Silence on a call is a social event that has to be managed. The ordinary courtesy of not leaving another person hanging, the courtesy that makes somebody decent to deal with, is what holds them in the exchange. Courtesy is not a weakness of character. Courtesy is what answers a neighbour who asks a question in the corridor.

Notice what has already happened here. Two of the things doing the work on a voice call are courtesy and responsiveness. Both are qualities a household would want more of rather than less. Neither is a lapse. The channel converts them into staying on the line, and staying on the line is all the channel needs.

What is Smishing, and why is a message counted separately?

Smishing is social engineering that arrives as a short message. A message is counted apart from writing generally because its shortness changes what it can do and, more usefully, what it cannot.

A message cannot argue. A message has room for one claim and one instruction, and no room for a supporting structure. The shortness sounds like a weakness and it is, but it is paired with something the other two routes lack: a message waits. A message sits on a device until it is opened, so it arrives when the recipient is distracted, in a queue, half asleep, or in the middle of something else. The short message trades away persuasion and buys timing instead, and timing is often the better purchase.

A message also gets to borrow context the recipient supplied. A message reading that a payment did not go through lands very differently on somebody who happens to have made a payment that morning. Nobody sending it knew that. The advantage is arithmetic: with enough messages sent, some land on the day the thing they mention actually happened. On that day the recipient completes the message themselves, so the message needs to do almost nothing.

Here is the household version. A note is pushed under two hundred doors saying the parcel could not be delivered. In a hundred and ninety of those homes it is nonsense and is thrown away. In ten of them somebody is expecting a parcel, and in those ten it is not a claim to be assessed at all. The note is a confirmation of something already believed, and confirmations get checked far less carefully than claims.

What is Impersonation, and why is it what all four channels do on arrival?

Impersonation is occupying a position of trust that belongs to somebody else. Not pretending to be a particular named individual, rarer and harder, but standing in a position and letting the trust that attaches to the position do the work.

The distinction between a position and a person is the one worth holding on to. Trust in ordinary life is mostly attached to positions rather than to people, and that is a feature of how society works rather than a flaw in anybody's judgement. Nobody knows the person at the electricity counter; the counter is what is trusted. Nobody knows the conductor personally; the uniform and the ticket machine are what is trusted. A society in which everybody had to establish personal trustworthiness before any transaction could happen would grind to a halt in a morning.

So positions carry trust, positions are visible from outside, and standing in one costs nothing. Occupying a position is the whole of impersonation. On 14 September nobody claimed to be a specific named person. Somebody occupied the position of an institution, and the trust that lives in that position arrived with it, unearned and automatic, exactly as it does when it is legitimate.

Impersonation belongs alongside the three routes rather than after them. Writing, voice and message are how the thing arrives. Impersonation is what it does the second it has a person's attention. Whichever route it took, by the time anything is being decided the dealing is with a position rather than a person, and the position was never verified because positions in ordinary life never are.

What was the mechanism actually doing to Ashok Bhosale?

Three levers, and not one of them is exotic. The three levers are documented, they have been written about for decades, and they are used in perfectly ordinary settings every day by people with no bad intent whatsoever. The ordinariness is the point. If the mechanism required something rare, it would be rare.

The first is authorityAn authoritative frame that produces compliance whether or not any real authority stands behind it, because the frame is what people respond to.. The caller occupied the position of an institution, and Robert Cialdini set out at length why an authoritative frame produces compliance whether or not any authority is actually present. The response is to the frame, not to a verified fact about who is speaking, and it is fast because it has to be fast. A person who paused to establish the standing of everybody who spoke to them with any authority would never get through a working day.

The second is urgencyTime pressure that stops a person evaluating and starts them complying, because evaluating needs a kind of attention that pressure takes away.. There was a problem, and it was happening now. Daniel Kahneman set out what time pressure does to a person, and it is not what most people assume. Pressure does not make a person evaluate faster and worse. Evaluating draws on a slow, deliberate kind of attention, and that is precisely the kind pressure takes away. Pressure stops the evaluating and starts the complying. The urgency in a call is not there to make a person move quickly at the same task. The urgency is there so that the assessing never starts at all.

The third is specificity. The caller used Ashok Bhosale's name and the last four digits of an account number. No single author has to be credited for this one. Specificity converting a plausible frame into a settled one is the oldest observation in the set. A frame that is merely plausible leaves a question open. Two accurate details close it, and once it is closed nobody reopens it. Reopening a settled question is work, and there is no obvious reason to do the work.

The ordinariness of all three is worth sitting with. A doctor's coat is an authority frame, and it is meant to work. A queue that closes at four supplies urgency, and urgency is wanted too. Otherwise nothing would ever finish. Somebody in an office using a customer's name and reference number is being competent, and a customer would complain if they did not. All three levers are load bearing parts of ordinary life. Load bearing parts cannot be removed, and nobody has a defence built out of resisting them.

What happened minute by minute on 14 September?

The times are the household's own, recorded afterwards. The call connected at 11:38. Rs 12,000/- left at 11:42, four minutes later. Rs 6,000/- left at 11:47, five minutes after that. Ashok Bhosale understood what had happened at 11:53, eleven minutes after the first transfer.

Eleven minutes is fast. Somebody whose own gap was two hours or two days will otherwise measure themselves against eleven minutes, so saying so plainly matters more than leaving it as an implication. Most people take considerably longer, and the reason has nothing whatsoever to do with intelligence, education or care. Ashok Bhosale runs a tailoring counter, does his own accounts and reconciles his own takings at the end of every week. The call was built to produce compliance and it is good at producing compliance, and it worked on somebody who handles money competently every single day.

Why is being careful not the defence it sounds like?

Carefulness is attention applied to content, and that is all it is. A person listens harder, checks what was said against what is already known, and looks for whatever does not fit. Carefulness is a good instinct and it is the right instinct almost everywhere else.

Now put it against a call whose content is correct. More attention finds more things that check out, so carefulness does not merely fail here, it walks a person further in. The name is right, and checking it confirms that. The four digits are right, and checking those confirms it too. The problem described is a problem that genuinely occurs. Every act of careful verification returns a pass, and each pass raises confidence a little, and by the fourth pass the person on the call is no longer a suspicious one. The listener is somebody who has checked several things and found them all in order.

The rising confidence is the intended path, not a side effect. A call built out of true statements is built that way because true statements survive inspection, and a person who inspects them comes out the other side more settled than they went in.

The ordinary advice to be careful is therefore a strange kind of advice. Being careful is not neutral advice that happens not to work. Being careful is advice pointed in the wrong direction, and following it harder moves a person further along the path the call needs them to take. A household that hears be careful and responds by listening more attentively has done exactly what produces the outcome.

Here is the everyday version, the one that can be felt. A shopkeeper hands over a note, and it goes up to the light: the paper is felt, the thread checked, the numbers in the corner looked at. Every check a person knows how to run passes. More of the same checks cannot establish whether the test being run is the right test. Carefulness improves the answers to the questions a person already knows to ask, and it cannot generate the question they were never going to ask.

What did those five minutes actually cost the Bhosale household?

Numbers next, and the number is the part that does not argue. The buffer, built across earlier months of this household's arithmetic, stood at Rs 31,320/- on the morning of 14 September. Ordinary monthly spending for the household is Rs 42,770/-, so that buffer covered 0.73 of a month.

Rs 18,000/- is 57.5 per cent of the whole bufferThe money a household keeps aside so that an ordinary shock does not have to be met by borrowing. It is measured in months of what the household spends.. Work it the other way and the same figure appears: Rs 12,000/- is 38.3 per cent of Rs 31,320/-, Rs 6,000/- is 19.2 per cent, and the two together come to 57.5 per cent. Cover fell from 0.73 months to 0.31 months, and the arithmetic there is nine months of household saving undone inside five minutes.

The loss is not a curiosity about human psychology. The psychology is interesting and the consequence is a household that now has thirteen thousand three hundred and twenty rupees standing between it and the next thing that goes wrong, when it used to have thirty one thousand three hundred and twenty. Nothing about that is theoretical.

Why does it work on people who already know all of this?

Because knowing is stored in one place and answered in another. Knowledge about these calls sits in the part of a person that reads, considers and concludes, and the call is addressed to the part that responds. The two are not the same part, and the second one does not consult the first before acting.

Evidence for this is everywhere in ordinary life, in settings with nothing to do with money. A horror film is known not to be real and the flinch comes anyway. The aeroplane is known to be fine and the hands tighten anyway. A queue at a counter is perfectly well understood and the small pressure to decide quickly still arrives when the person behind the glass is waiting. In every one of those cases the knowledge is complete, correct and available, and it does not intervene. The response is faster than the consultation.

A call adds one thing on top of that. A call is happening in real time, to a particular person, with somebody waiting. Knowledge is a thing a person has; a live conversation is a thing they are inside. Everything known about these calls is a description of a general category, and what is in front of them is a specific case with their own name in it, and the specific case does not present itself as a member of the category. The specific case presents itself as a Tuesday morning problem with a recurring deposit.

The gap between knowing and responding is why people who look at these professionally are still taken. Being taken is not carelessness on their part any more than it was on Ashok Bhosale's, and their knowledge of the mechanism is not merely greater than a household's, it is far greater. Being taken is not evidence about how much somebody knew, and any account implying otherwise would be teaching something false as well as something cruel.

What defence actually works, and why is it a habit rather than a skill?

One habit. Not a checklist, not a set of warning signs, not a rule about which callers to distrust. Never act inside a conversation somebody else began. The conversation is ended, and contact is made through a route that existed beforehand.

The power of that rule is in what it does not contain. The rule contains no judgement about the caller. The rule contains no assessment of whether the story is plausible. Nobody is asked to detect anything, spot anything or notice anything. Suspicion of a person who may well be entirely legitimate is not required, and nobody has to be right about them. The rule depends on judging nothing, so a caller who is more convincing than the last one cannot defeat it.

The rule does the same work on all four channels at once, and that is worth setting out. A written thing asks for action inside the written thing; instead the action goes through a route that existed beforehand. A voice asks for action inside the call; the call is ended and a fresh one begun. A message asks for action inside the message; the same applies. Impersonation is standing in a position of trust that arrived with the contact, and beginning the contact afresh means the position reached is one the household chose rather than one that was presented to it. One habit, four channels, no expertise.

The phrase a route that existed beforehand is doing real work in that sentence and has to be exact. Such a route is one that was in place before this conversation started: something written on a card that has been in a wallet since before today, a branch physically walked into, a passbook, a statement held last month. Such a route is not a number the caller supplied, not a number in the message, and not a link inside whatever arrived. The test is simply time. Did this route exist before the contact that is now asking for it to be used?

The shape of what this habit costs is worth seeing. If the caller was genuine, ending the call and making a fresh contact costs four minutes and a small awkwardness. If the caller was not, it costs the attacker everything. The entire mechanism lives inside a conversation that has now ended. The asymmetry is why the habit can be absolute. There is no case in which applying it produces a serious loss, so it never has to be weighed, and anything that never has to be weighed can become automatic.

How does a household put that habit in place on an ordinary day?

A habit that exists only as a written sentence is not a habit. A habit is made by deciding in advance, out loud, when nobody is under any pressure. When the pressure arrives there is then nothing left to decide. In practice, for a household, that looks like the following, and none of it is technical.

The first part is agreeing, as a household, that ending a contact needs no justification to anybody. The agreement sounds trivial and it is the load bearing part. Most people stay in a conversation they want to leave because leaving feels rude, and courtesy is a real force. The household decides once, in advance, that hanging up on somebody who may well be entirely legitimate is acceptable. Nobody then has to make that decision while a voice is waiting.

The second part is knowing, before anything happens, which routes are already in hand. Not looking them up during a call, the moment when a caller can helpfully supply one, but knowing them the way a person knows the way to their own street. The routes are written somewhere the household can see, in whatever language the household actually uses. None of this is about technology. The whole of it is knowing where to go before anybody asks.

The third part is the one people skip. Somebody in the household will be contacted at some point, and the person it happens to should already know that the household's response is to help rather than to ask why they did not notice. Making it safe to say what happened is not sentiment. The gap is between hearing about it at 11:53 and hearing about it three days later, and three days later is how most of the delay in most of these events actually accumulates. A household that has made it safe to say what happened finds out sooner, and finding out sooner is worth more than any amount of vigilance.

Now consider the same problem from the other side of the counter for a moment. Somebody whose work is looking at these events all day does not see one clever call. Such a person sees the same handful of shapes arriving over and over, aimed at very large numbers of people, with an outcome that depends far more on when the contact happened to land than on who received it. From that seat, the idea that being taken says something about the person is not so much unkind as inaccurate. Social engineering is a volume operation, and volume operations do not select for the incautious.

What is true for somebody it has already happened to?

Every instruction above is written for a next time, and not one word of it describes what should have been done last time. The distinction is not a politeness. The distinction separates an account that is useful from one that does harm while sounding helpful.

The habit set out above will hold from now on. The habit says nothing whatever about a contact that has already happened. The habit was not available at the time, and a habit is not a thing anybody has until it has been decided in advance. Reading it now does not retroactively mean it could have been applied then.

The response after an event, in what order and how quickly, is covered separately, and so is what a record is worth and how to build one. Where money has moved and nothing has been reported yet, the ordered response is the thing to read next.

The last thing, and it is said plainly. The Bhosale household does not get the Rs 18,000/- back. Reporting does not usually recover money, and a story that ended with the money returning would be a comfort written at the expense of every reader whose money did not return. The household has instead a record, a report made in the time it managed, and a changed set of habits. And that is what there is.

The Bhosale household, Meghna Bhosale, Ashok Bhosale and Ira Bhosale are invented.
Educational material. Not advice on any investment, tax, budget or market position.