Psychological Hacking: How Can You Avoid It?

Psychological hacking plays on various irrational triggers to get you to click on fraudulent links. How can you protect yourself? Our tips.

Hackers target IT systems, but they also try to disrupt our reasoning and reflexes through psychological hacking. You've probably already received messages like this: "Parcel pending: click here to receive it" or "AMAZON: €10 voucher, just click here."

Psychological hacking: a common example

In this example, out of 12 emails, 6 are fraudulent. "We want to reward you!" "We tried to reach you, your reward is waiting!!" "Congratulations! You can get a €90 xxx gift card!"

Also look at this: two emails from "La Poste" (the Belgian postal service). Except the first one, "ATTENTION: you have a parcel that has not been received," is a lure, while the second, "There are changes to your important deliveries," is a genuine email from La Poste.

How can you tell the difference? It's simple: the first one pushes you to react urgently. The second is purely informative. The first uses a communication channel that La Poste never uses, at least not with the person who received this email.

What role does mental manipulation play in cyberattacks? What are the psychological triggers most commonly used by hackers, and how can you outsmart them? Becoming aware of these triggers is already a first way to protect yourself. That's exactly the purpose of this article.

How to outsmart hackers' psychological hacking attempts

Most of the messages (emails, texts) or calls we receive, whether at work or in our personal lives, don't require an immediate response. Don't act in a rush, even if the message you received is threatening, no matter who or which institution appears to be sending it.

In fact, are you sure that the sender really is who they claim to be? The name displayed can easily be spoofed. If in doubt, check the sender's legitimacy to make sure they really are the author of the message.

Here are two concrete examples:

• A colleague from the IT team asks you for your email login details to carry out a check?
• A relative asks you for an urgent bank transfer to cover medical expenses?

Take the time to call these people to check whether they really are behind the message you received. Also ask yourself whether the information is consistent and relevant.

In any case, don't click on every link and don't automatically open every attachment you receive, especially if you have doubts. It only takes one click to open the door to hackers.

Also, never share personal or confidential information — your account number, your passwords, your login details — by text, email or phone… even with people you trust!

What should you do if you've fallen into a trap set by hackers?

If you've lost money as a result of this kind of manipulation, it's advisable to file a report with the police station closest to where you live.

Also contact your bank if:

• You've shared banking information (your bank can block any fraudulent transactions)
• You've made a money transfer at the request of a scammer
• Money has disappeared from your bank account without you having authorised the transaction

Unless your bank can prove that you were seriously negligent, it is required to reimburse you for the money that was stolen. This resource from the FPS Economy can help you get a clearer picture.

Breaking down the messages sent by hackers

Becoming aware of the mental manipulation techniques used by hackers is a first step towards spotting them and protecting yourself. From a more practical point of view, you can also learn to break down the elements contained in hackers' messages. Very often, these messages try to get you to click on a link or open an attachment.

Urgency

In this example, a "Customer Service!" tells me they tried to reach me. The urgency plays on the words "Please reply!" Except… Which customer service? Which brand? Why did they try to reach me? Why do I need to reply?

Fear

Examples: "Suspicious activity has been detected on your account," "Your antivirus is no longer up to date."

Curiosity

In this example, the sender "Nutrazenith" tells me not to rely on chance, that the stakes are too high. Curiosity would push me to click on the link and try to understand this cryptic message.

The lure of profit

Another common example, which we also covered in our article on identifying fraudulent emails, is the lure of profit through new technologies, such as Bitcoin. The subject line of the email also plays on fear: "Invest before you miss out."

Trust or social proof

Example: "Your bank invites you to check and update your personal details. Click here to do so."

And many more…

It only takes one convincing email to get someone to enter personal information such as bank details and be extorted of several thousand euros. There's no shortage of examples.

These various triggers can of course be combined to put even more pressure on the user. There are others too, such as: a sense of responsibility, pride, or the desire to help. Psychological hacking helps hackers build more realistic attacks… and therefore more effective ones. Good news: you now know the techniques hackers use to influence your behaviour. So you'll be able to outsmart them more easily.

The role of psychological manipulation in cyberattacks

A human being is easier to manipulate than a machine. Hackers use various techniques to lower their victims' guard and get them to cooperate without paying attention to the consequences of their actions. This kind of practice is known as "social engineering."

Hackers are interested in human psychology. While some companies train their employees to be extra vigilant, individuals generally don't have this kind of training. Want to put yourself to the test? Visit safeonweb.be and take the phishing test!

What types of attacks use mental manipulation?

The main attacks carried out by hackers rely on mental manipulation, in particular:

• Phishing by email
• Phishing by text, or smishing
• Voice phishing (also known as "vishing")

Very often, this is just a first step that can lead to a much more advanced cyberattack: ransomware, data leaks, identity theft, money theft, and so on.

Don't hesitate to also discover our Safe & Connected assistance : it protects you in case of digital trouble!

Article written in collaboration with We are the Words.