Understanding Online Threats: Social Engineering

The introduction of BiMPay, the Central Bank of Barbados’ new national instant payment system, marks another significant step in the continued shift toward digital financial services. More than ever, how we pay, transfer, and manage money is moving online, offering greater convenience and accessibility. With this comes the need for awareness about how to stay safe in the digital space. 

To help users of online financial services, including BiMPay, better recognise these threats and how to mitigate them, we reached out to Anthony Harris, President of the Information Systems Security Association (ISSA) Barbados Chapter for advice on how Barbadians can protect themselves.

What is social engineering?  

Social engineering is when someone tricks you into giving up sensitive information or doing something you shouldn't, often by pretending to be someone trustworthy. It's more about manipulating people than hacking computers.

What is the goal of social engineering attacks?

The goal of social engineering attacks is to trick you into revealing private information like passwords or performing actions like sending money that benefit the attacker, usually by exploiting your trust or lack of caution.

What are some of the different types of social engineering attacks?

Some common types include phishing – fake emails or messages trying to steal your info; pretexting – someone pretending to need information for a fake reason; baiting – offering something tempting to get you to click or download; and smishing – fake SMS messages trying to steal your info. There’s also vishing – voice phishing calls, including AI voice/video calls (voicemails or “live” conversations with cloned AI voice) and tailgating (someone sneaking into a secure area by following you in). All of these rely on tricking people, not technology.

What are some of the tell-tale signs of each of these types of attacks?    

Phishing often shows up as emails or texts with urgent messages, suspicious links, or requests for personal info. Pretexting usually involves someone asking for details while pretending to be from a trusted company or authority. Baiting might offer free downloads, prizes, or deals that seem too good to be true, often leading to sketchy websites. Vishing can include pressure to act fast over the phone. For AI voice/video, it is lack of natural breathing, limited emotional depth, and voice/video glitching. Tailgating is when someone tries to follow you into a secure area without proper access, maybe by asking you to hold the door.

How best can I protect myself from falling victim to this type of attack?

Be cautious with unexpected messages or requests, especially if they ask for personal info or urge you to act quickly. Don’t click on suspicious links or download unknown files. Always double-check if someone is really who they say they are by calling back via official number, and don’t let strangers follow you into secure places. 

Trust your instincts – if something feels off, it’s worth double-checking.