Purpose – One of the key components to fraud prevention is strong internal controls. However, the greatest threat to an organization's information security is the manipulation of employees who are too often the victims of ploys and techniques used by slick con men known as social engineers. The purpose of this paper is to help prevent future incidents by increasing the awareness of social engineering attacks. Design/methodology/approach – A review of the more common social engineering techniques is provided. Emphasis is placed on the fact that it is very easy for someone to become a victim of a social engineer. Findings – While many organizations recognize the importance and value of having strong internal controls, many fail to recognize the dangers associated with social engineering attacks. Practical implications – Individuals and organizations remain vulnerable to social engineering attacks. The focus on internal controls is simply not enough and is not likely to prevent these attacks. Raising awareness is a good first step to addressing this significant and potentially dangerous problem. Originality/value – This paper provides a concise summary of the most common social engineering techniques. It provides additional evidence that individuals need to better understand their susceptibility to becoming a victim of a social engineer as victims may expose their organizations to very significant harm.
