How Can I Protect Against Social Engineering Hacks?

Dear Lifehacker,
My passwords are strong, but if hackers can convince tech support into thinking they're me with a few easy-to-Google details, what can I really do to protect myself? Also, how can I avoid being unwittingly manipulated by these kinds of attacks?
Concerned About Cons

Dear Concerned,
You're right to feel uneasy about hacks that depend only on human vulnerabilities—so-called social engineering hacks. As we've seen recently from the Apple and Amazon exploits uncovered in Mat Honan's hack, skilled hackers can easily bypass technical protections (like strong passwords) and get the information they want just by talking to a person. People are, by far, the weakest link in any security system's chain.


First, What Is Social Engineering?

How Can I Protect Against Social Engineering Hacks?



  • A hacker might call saying your credit card has been flagged for unusual activity and the bank needs to verify your information (credit card number, mother's maiden name, etc.) before issuing a replacement. He or she will offer up the last four digits of your card and perhaps the date and amount of a recent transaction (things easily found in your trash) to gain your confidence and make this sound legit.
  • And, as we've seen recently, hackers can get into accounts through lax company procedures which require only minimal bits of information (e.g., billing address and email) to identify users.

Social engineering, as you can see, relies on our gullibility and the limited amount of information we use to verify people's identities. Photo by Jared and Corin

Before you say this is common sense and that you would never fall for such a trick, know that even tech-savvy people are vulnerable to sharing personal information. When the hacker appears to be in a position of authority or acting for the boss, it's even harder to say no, as this Wal-Mart hack shows.

How to Avoid Being The Victim of a Social Engineering Hack

The most important thing you can do to prevent being socially engineered yourself is to embrace healthy skepticism and always be as vigilant as you can. Just being aware of common tricks puts you one step ahead of the game (but don't get too cocky—remember, question everything).

Never give out any confidential information—or even seemingly non-confidential information about you or your company—whether it's over the phone, online, or in-person, unless you can first verify the identity of the person asking and the need for that person to have that information. You get a call from your credit card company saying your card has been compromised? Say okay, you'll call them back, and call the number on your credit card rather than speaking to whoever called you.


How Can I Protect Against Social Engineering Hacks?


Corporations really need to train their employees to spot social engineering hacks and fix their systems to prevent easy hacking. For your own protection, it helps to know the basics of phishing attacks and how to protect against them. is an excellent resource for learning how the "art of human hacking" is accomplished, and EnterpriseITPlanet's AntiOnline forums have many more examples of social engineering attacks, as does CSO.

Minimize The Damage Done from Socially Engineered Attacks

You can protect yourself from phishers, scammers, and identity thieves, but there's only so much you can do if a service you use is compromised or someone manages to convince a company they're you. You can, however, take a couple of preventative measures yourself (some of which we mentioned previously after the recent Apple and Amazon exploits).

  • Avoid having all your eggs in one basket (or the dreaded "single point of failure"): The more intertwined and dependent your accounts are the more widespread the damage a security breach can cause you—e.g., if you use your Gmail address for every service's password recovery.
  • Regularly back up! No explanation necessary, right?

These steps won't prevent your account from being compromised if a service provider falls for a social engineering hack and hands your account over to the attacker, but they may at least minimize the damage possible and also give you more peace of mind that you're doing as much as you can to protect yourself.


P.S. Have anything to add? Post it below for all to see.

Have a question or suggestion for Ask Lifehacker? Send it to