Social Engineering

What Is Social Engineering?

Social engineering is the targeted manipulation of people in order to obtain confidential information or login credentials. Attackers exploit human characteristics such as helpfulness, trust, fear, or respect for authority. Social engineering can be used online (e.g., via email) or offline (e.g., by post).

What Forms of Social Engineering Are There?

• Phishing: You receive manipulated emails, messages, or voice messages that appear to come from a trusted sender. The goal is to trick you into entering passwords or account details or clicking on a malicious link. Variants include spear phishing (highly personalized emails) and whaling (targeting executives or other high-ranking individuals). On WhatsApp, you often see chain messages or supposed warnings (e.g., “Your account will be blocked”) that lead to a fake support page. Fake giveaways on Instagram, TikTok, or Discord, where you are asked to click a link to supposedly win something, are also common. (See Phishing.) Phone calls are another way phishing can be carried out (vishing).
• Pretexting/Impersonation: The attacker creates a false scenario and pretends to be a trustworthy person. For example, they may claim to be from a government agency or the support team of a social media platform and offer to solve an invented problem if you provide certain information.
• Catfishing: Scammers create fake social media profiles (often posing as influencers or people of a similar age) and build online friendships in order to exploit your trust later. They might, for example, persuade you to share personal photos, confidential information, or access to your account.
• Baiting: You are promised something attractive in order to lure you into a trap. For example, you might be offered a supposedly free game or music download that actually contains malware. Modern examples include “free” downloads infected with malware or found USB sticks that you plug into your device, immediately installing a virus.
• Scareware: Here, fear is used to manipulate you into acting without thinking. A typical example is a sudden pop-up message on your phone or computer claiming that your device has been infected with a virus or that you have violated the law. You are then asked to purchase expensive software or enter codes. In reality, there is usually no actual problem: paying does not provide any benefit and may instead give strangers access to your data.

How Can I Prevent and Recognize Social Engineering?

• Be suspicious: If someone unexpectedly asks for sensitive information, pause and think before responding. Hackers often try to create a sense of urgency. Take a moment, carefully check the sender and the content, and trust your instincts.
• Never disclose security codes: Legitimate services or authorities will never ask for your password, TAN, or SMS code. Never share these codes with anyone, even if the caller or message seems extremely convincing. Remember: security codes sent via SMS or messenger are intended only for you. Never pass them on!
• Keep data protection in mind: Think carefully about which personal information you share online. The less cybercriminals know about you, the harder it is for them to target you directly. Set your profiles to private and be careful about sharing your date of birth, address, and other personal details.
• Don't blindly trust links: Don't immediately click links in messages from strangers or unusual senders. Instead, hover over links with your mouse or tap the sender's name to check whether the address is legitimate. If you are suspicious, verify the message through another channel (e.g., call the company directly).
• Use technical safeguards: Use strong, unique passwords for all accounts (ideally with a password manager) and enable two-factor authentication (2FA). This provides additional protection for your account even if someone knows your password. Always keep your software and apps up to date and use antivirus software on your devices to detect malicious software at an early stage.
• Check your devices: On WhatsApp and similar services, you can check under “Linked Devices” to see whether any unfamiliar computers are connected to your account. It is recommended that you check this list regularly and immediately log out any unknown devices.
• Question urgent warnings: A warning such as “Your account will be blocked” or “Breaking news: You must act immediately” often has a catch. In such cases, it is best to consult someone you trust (parents, teachers, or an experienced friend) before taking any action.

What Can I Do If I Have Become a Victim of Social Engineering?

• Change your password: As soon as you suspect that someone has gained access to your account, change the password immediately — ideally using a different, secure device. Follow good password guidelines and use a long, unique combination.
• Recover your account: If you have lost your password, try using the platform's “Forgot password” function. Many providers send a password reset link to your email address. If this does not work (the attacker may also have compromised your email address), contact the service's support team directly. Many providers have a process for proving that you are the legitimate account owner.
• Security codes and 2FA: Enable two-factor authentication if you have not already done so. Never give other people codes you receive via SMS or an authenticator app. Remove any forwarding rules that may have been set up (e.g., for email) and restore your mailbox settings.
• Clean your devices: Scan your smartphone and computer using up-to-date antivirus software. Uninstall apps you do not trust and remove unused programs. Also check the settings and passwords of all other services that use the same login as the compromised account — change them as well to prevent further attacks.
• Secure your communications: Inform your friends or contacts that your account has been hacked so that they can remain vigilant. Scammers may subsequently try to use your profile to deceive other people. By warning them, you can help prevent them from falling for fake messages as well.
• Migrate your accounts: If you can no longer regain control of an account, create a new one — especially in the case of email or social media accounts. Inform all important contacts and organizations (bank, school, family, websites) that your old address has been compromised and have all activity associated with that account stopped.
• Sources of help: Do not hesitate to seek help if you have become a victim of social engineering. Talk to people you trust, such as your parents, teachers, or friends, about what happened. There are also online services specifically for young people. For example, JUUUPORT (help from young people for young people, particularly in cases of online scams) or the “Nummer gegen Kummer” child and youth helpline (116 111) provide anonymous and free advice. The police are also a point of contact: many German federal states offer online police portals where you can report cyber incidents. In serious cases (e.g., blackmail or financial loss), it is advisable to contact the police. You can report content for removal or reporting via Netzmelden.de.