Hacking: The Next Generation

Social Engineering Call Centers

Social engineering is the art of obtaining information from people who don’t want to give it. Journalists, law enforcement officers, and lawyers learn these skills as a trade. They learn techniques to intimidate or sympathize with a person so that the person “reveals her hand.” Attackers use similar techniques to gather sensitive information from unsuspecting victims.

Call centers are a target for social engineering because they offer a great way to directly interact with employees from a given company. The company call center provides an attacker with a large population of targets. If these targets become hostile or become aware of the attacker, the attacker just needs to hang up and try again.

Attackers often seek targets who are new to the organization, are easily intimidated, or don’t like dealing with confrontation. Call centers allow the attacker to leave a small footprint, meaning there is little chance the organization will even know that it is being attacked.

A sample conversation between an attacker posing as a consumer and a call center employee may go something like this:

Employee: Thank you for calling Large Organization. Can I get your account number?

Caller: Yeah, sure. I think it is 55560-5-2219, but I could be wrong. I haven’t called in before.

Employee: That’s all right; give me a few minutes while I look up that account’s information.

Caller: No problem. How is your day going? (Jovial tone)

Employee: I can’t complain. It’s just been a little ...