What is social engineering fraud?
Understand your social engineering risks and what you can do - written by Simon Taylor
Social engineering fraud can exploit a person’s natural tendency to want to avoid doing something wrong
The manipulation of employees to bypass digital security is on the rise and is more commonly referred to as social engineering fraud.
What is social engineering fraud?
Protection for social engineering fraud can be provided under a cyber insurance policy.
It is estimated that sophisticated and well-funded criminals continue to defraud businesses hundreds of millions each year through social engineering fraud, with a Financial Fraud Action UK study having shown:
- 7 in 10 business leaders admitted they hadn’t taken any action to protect their business;
- 1/4 businesses admitted they had been victim to scams or had scams attempted;
- 1/2 of business leaders do not believe an act of fraud will be committed against them; and
- The most common targets for fraudsters are senior management and business owners in SMEs (67%) where controls are less stringent.
Common types of social engineering fraud:
Imposter fraud
Invoice Fraud
How to prevent social engineering fraud?
A social engineering fraud preventative strategy should include:
- A dual authorisation process for the transfer of funds that requires authorisation from at least two persons, with both responsible for reviewing the supporting documentation to validate the request.
- A call-back procedure to a previously established contact number, for any transfer request to a new bank account or to amend the details of an existing bank account (rather than any contact information included with the payment request).
Are we covered by our bank?
Your bank must refund you for any unauthorised payment. However, your bank can generally refuse a refund for an unauthorised payment on the basis:
- it can prove you authorised the transaction; or
- it can prove you are at fault because you acted deliberately, or with ‘gross negligence’ and failed to protect your details that allowed the transaction.
Are we covered by our insurance?
Social engineering fraud has been a problem area over the last several years because of the significant increase in frauds. There have been a number of insurance claims challenged under ‘funds transfer fraud’ coverage extensions, however the requirement for a 'theft' to occur was not met.
Fortunately, a number of insurers have sought to provide affirmative cover under ‘Social Engineering Fraud’ extensions. Please note that cover is usually sub-limited, may contain a specific deductible and will cost an additional premium.
What is the social engineering fraud threat?
With recent improvements in cyber security to stop hackers and cybercriminals, it is commonly accepted the weakest link in your defence are your employees.
About the author
Simon Taylor is a respected senior industry professional and a Chartered Insurance Broker with over 20 years’ of experience in the commercial insurance sector as an underwriter, broker and director.