I’m sitting in a meeting room in Cambridge when a photo of a cat in a jigsaw box appears on the whiteboard. “Is this your cat?” asks anti-fraud expert Steve Goddard. I nod. “Is he called Chester?” I nod again.
And so begins a whistlestop tour of my life online. My delight at seeing my cat’s sit-down protest against my puzzle addiction slowly turns to unease about the overall picture that Goddard, who works for a company called Featurespace that detects and prevents scams, has been piecing together.
In the next five minutes I discover that details of my school lunchtime activities are available if you know where to look, that I take far more photos of flowers than I had realised, and that I have offered scammers enough information for them to have a chance of reeling me in.
Scamdemic: readers’ £1m losses highlight scale of the UK’s fraud crisisRead more
These snippets are tools that Goddard says a fraudster could use as a starting point to “socially engineer” me – someone could use them to gain my trust and manipulate me into handing over details they could then deploy in a scam. “It starts to disarm you because you think ‘no one would ever know that’ and you think ‘I must know them,’” he says.
View image in fullscreenHilary Osborne’s cat Chester. Photograph: Hilary Osborne
Goddard shows me a tweet where I expressed my despair at a delivery firm failing to find my house, and suggests it would have been easy for someone to pose as the courier and get more out of me. Or, he suggests: “If I wanted to socially engineer you I could pretend to be a student from your old school who wanted to get into journalism.”
It’s true. It would not occur to me that the person was a scammer because I had no idea that all of this information is out there. And once my guard was down I might start to give away information that could be used to part me from my cash.
In the first half of this year, £355m was lost in the UK to authorised push payment fraud, where people transferred money to scammers’ accounts. Some of these crimes began with fraudsters socially engineering victims they had met on dating sites. Others with people being contacted by someone pretending to be from a bank’s fraud department, and manipulating them that way.
“Criminals are increasingly evading banks’ advanced security systems through social engineering scams that target people directly and trick them into giving away their money and personal or financial information,” says UK Finance, the banking trade association. Impersonation scams, where a criminal calls and pretends to be from a trusted organisation, such as your bank, have been increasing. “Criminals do use information from open sources on the internet to build a picture of their victim to target,” it adds.
Rory Ines, founder of the Cyber Helpline, a voluntary organisation that supports people who have been scammed, says it sees a large number of victims who have been tricked with social-engineering tactics “and this is growing all of the time”.
I have always thought that I had been quite careful online – giving away enough about myself to enjoy conversations with people I’d never met, yet avoiding those games where you reveal the names of your first pet, your mum’s maiden name and simultaneously all of your bank passwords. But the demonstration showed me there were things I’d forgotten about and made it clear that information other people were sharing was adding to the picture.
The starting point was Facebook. Thanks to that, and my failure to ever make my account private, Goddard was able to declare: “We know where you work, we know where you went to school and we know where you come from.”
From there, via my tweets about Scouting, Goddard had been able to find several of my old addresses. And via old copies of my school magazine uploaded to its online archive he was able to remind me of my success in talking about Welsh rugby and feminism without deviation or hesitation in a sixth form Just a Minute competition.
However, my current address is not online – we have opted not to appear on the open version of the electoral register. And I have turned off geo-tagging on my photos, so it is not obvious where they were taken. These are both good steps to take.
View image in fullscreenMaking your Facebook account private is a good start to being more secure online. Photograph: Alamy
Steven Murdoch, professor of security engineering at UCL, says rather than employing Goddard’s thorough approach to research someone, most criminals will use more basic techniques, such as phishing emails and texts, to get the information they want. “Their current techniques work really well and get them lots of money,” he says. “When they are targeting someone [like] the boss of a company, that’s when you start to see more investment in time to get the social engineering to work.”
Goddard says it is impossible to determine how often these techniques are used, and there is no separate category for them in UK Finance’s statistics.
A couple of years ago, Cash featured the case of a firm that was scammed after one partner responded to a genuine tweet from Metro bank. A fraudster who saw the tweet called and pretended to be from Metro and persuaded them to give enough other details for their account to be hacked.
“The social engineering type of attack does not tend to scale [up] easily given the time and effort required to succeed, and therefore is more often than not used by individuals rather than the ‘call centre’ approach of criminal enterprises,” Goddard says. “The trigger to target an individual could be targeted, or opportunistic such as overhearing a conversation or getting access to sensitive or exploitable information like a picture or bank statement.”
Maybe if I was in the paper celebrating a lottery win, or on social media talking about an inheritance, a fraudster could decide it was worth a bit of effort to find a way to gain my confidence.
For Goddard’s team, understanding what information people give away, and how they can be socially engineered by fraudsters is an important part of work to design systems to stop scams. The company provides banks with software that detects unusual behaviour and flags up payments that look problematic.
“Some of this you can’t control, but it’s having the awareness that it’s there,” says Goddard.
Murdoch says people will always give away details online, and rather than asking customers to change their way of life, banks should be looking at their own systems. But until they make changes, it seems worth checking what you can find out about yourself online and deleting, or making private, anything you feel unhappy about people seeing. You can make it harder for criminals by removing some pieces of the jigsaw puzzle.
