Social engineering: how to recognise CEO fraud and vishing?
Not every attack arrives via email. Phone, SMS, LinkedIn message — modern social engineering uses every channel. Three patterns and how to counter them.
Phishing is email. Vishing is phone. SMishing is SMS. Social engineering is the umbrella term — manipulating people into doing something they normally wouldn't.
\n\nCEO fraud
\n"This is the CEO. Urgent — I need gift cards for a deal, €5,000, right now. Keep it quiet until tomorrow, PR moment." Always fake. Always.
\nCounter: process — vouchers/expenses above a threshold must go through approval via an official channel. No exceptions, no urgency.
\n\nVishing CEO fraud
\nA phone call (which may use a deepfake voice by 2026). "This is [company]'s bank — we've spotted suspicious transactions, could you confirm your login details?" Banks never ask for this.
\nCounter: hang up, call back on the official number. Never give login credentials over the phone.
\n\nLinkedIn / help request
\n"I just joined [your company] — can you help me log in? My onboarding email never arrived." Could be a former employee or a competitor simply having a go.
\nCounter: verify through HR. Never help without verification.
\n\nInvoice fraud
\n"Your supplier has a new bank account number. Please transfer the outstanding invoice there." Usually sent via a spoofed — or compromised — email from the supplier's actual mailbox.
\nCounter: always verify a change of bank account by phone, using a number you already have on file (not one taken from the email).
\n\nTraining
\nSee recognising phishing — but run simulations by phone and SMS too, not just email.
\n\nSee also: security pillar.
Volledige gids: Seguridad para pymes sin departamento de TI: ¿qué haces este trimestre?
Dit artikel is onderdeel van onze uitgebreide Security zonder IT-afdeling-gids. Lees de pillar voor het complete plaatje.
Lees de pillar →