Try to verify the sender's e-mail address first. If the sender's address doesn't match the format of your workplace addresses, it's time to pay attention. In the environment of Masaryk University, you can verify the e-mail addresses of people here.

If you become suspicious, contact the person through a different communication channel, for example, through a personal e-mail address social networks, or try to call the person.

At that moment, Erika had no idea that she became a victim of so-called Baiting – a method of social engineering that uses our natural curiosity. In this case, the attacker's goal was to motivate one of the workers to plug the medium into his/hers workstation using an inciting label on the drive. While Erika was looking for photos, malicious software had long been running behind her back, which may now have control over her computer. What will she do with it?

When accessing any file, the O365 will never want to confirm access to your account from you (whether it is a contact list, changes in a calendar, or something else).

Every application should always request access only to items related to its primary activity. If Tibor opens a link to a Word document from O365, why should the application want to access its calendar or read all his files?

One day, Martin took public transportation to school, as he did almost every day. He decided to check if he had received brigade pay. As usual, the tram was crowded, but he managed to take a seat. When he signed up, he didn't notice the strange man behind him, who had a direct opportunity to look at his internet banking application form. What may have saved Martin's paycheck, and how to prevent a similar situation?

Tailgating is a method of social engineering that takes advantage of the situation, especially in large organizations. These workplaces are often characterized by not all employees knowing each other. It makes it harder for them to distinguish who works there. And that's what the attackers are betting on. It is enough for a successful attack like this to act self-confidently and, ideally, distract the victim. Once an attacker gets into the workplace with restricted access, he can cause a whole lot of trouble. From stealing data from unencrypted drives to deploying malicious code to the manager's device. How can Roman and you defend against Tailgating?

So what happened? Mia immediately got suspicious about malicious software on her computer. However, the explanation is much more straightforward. The so-called Trashing is a technique of social engineering, where the attacker tries to obtain the information out of the trash from the office. Yes, you are reading right. That is how the rate sheet got to the internet, from where probably no one will ever delete it. So how do you defend yourself against Trashing?

Do not share your phone number publicly if it is not necessary. Don't reply to the received message, and in any case, don't call the number back.

Don't click on the attached link in SMS messages before checking the sender's identity. You can verify the phone number through social networks or try typing it in a browser and reading the reviews.

If you suspect that the message you received doesn't have the purest intentions, don't hesitate to report it to your employer and, in the case of Masaryk University, to the Cybersecurity Team.

Why did Andrew tend to open this e-mail? That's because it was directly related to his job, and that's what the attackers bet on. In addition, the fraudulent e-mail disguised itself quite well among other business e-mails. What could Andrew do to ensure that something wasn't just right? And what rules can you follow?

Eva was naturally confused and frightened for a while, but she quickly realized it must be a fraudulent phone call. We shouldn't share our login detail with anyone, let alone the PIN. She was right. She became a victim of Vishing – voice-pishing is a technique similar to pishing, but using a fraudulent call instead of an e-mail to lure sensitive data from the victim.

As soon as she realized her situation, she did not disclose any information to the fraudster and hastily ended the call. But what should you or Eva do next in a similar situation?

Ideally, you should write down the number that was calling you, the time of the call, and the details the attacker was interested in. In summary, collect as much information about the call as possible.

It is good to contact the police with the collected information – it can significantly help catch the perpetrator and prevent other similar attempts, which may not end as well as in Eva's case.

Similar phone calls may not be limited to bank accounts. The voice from the other side of the phone may be pretending to be a Microsoft support with intent to gain access to your computer using an insidious story...

Nicholas fell victim to a relatively new technique called quishing. In this technique, the attacker wants the victim to scan a QR code that leads them to a phishing or infected website. In Nicholas's case, the attacker used this technique to enhance a spear-phishing attack because QR codes can install more trust than traditional URLs. So, how can you protect yourself against this deception?

Just as you are cautious with unsolicited links in emails or messages, you should also be vigilant when scanning QR codes that you did not expect or that come from unknown sources.

After scanning a QR code, pay attention to the URL of the website. If it looks suspicious or does not match the expected address, do not proceed to the site. If you happen to land on a suspicious site, do not download anything from it.

Some QR code scanning apps (e.g., QR Code & Barcode Scanner) have security features that check URLs against known fraudulent sites before redirecting you.

IN CONCLUSION

Social engineering techniques can be a daily threat to everyone in cyberspace – and partly beyond. We have introduced you to some possible scenarios, but their primary purpose is to show how creative the attackers can be and not spare anyone. Let's sum it up. Here are the basic steps to prevent social engineering techniques that can be easily applied to our everyday lives: