How Do Hackers Get In? Social Engineering Explained for Small Businesses

By J. Mesa

Thanks to Hollywood, most people picture a hacker as a hooded figure in a dark room, with a wall of monitors and streaming green text. The real ones look like anyone you pass during the day. They use practical, boring methods, and those methods work.

The most common method is social engineering. This post explains what it is, why small businesses are targets, and how to defend against it.

What is social engineering?

Social engineering is the use of deception to get a person to do something that helps an attacker: click a link, open a file, share a password, or send money. The attacker goes after the person in place of the technology.

It is the first step in most multi-phase attacks. A tricked employee downloads malware or gives up a login, and the attacker builds from there.

Are small businesses too small to be a target?

No. That belief is one of the most damaging misconceptions in small and medium-sized business (SMB).

In 2021 the United States had about 32.5 million small businesses, close to 99.9 percent of all US businesses. The pandemic pushed more of them online, which multiplied their exposure. That is an enormous pool of potential victims.

Why do attackers prefer SMBs?

• There are so many of them. Volume makes up for smaller payouts.
• Attacks are automated. Software sends the emails and scans for weak systems.
• Hacking tools are for sale. Criminals rent tools and services. Think of an online marketplace for hackers.
• The risk to the attacker is low. Small businesses seldom have the means to investigate or pursue them.
• Defenses are thinner than at a large company.

The cost to a victim goes beyond money. A breach damages a reputation for years. Remember Equifax.

What are the most common social engineering techniques?

• Phishing. Mass emails that imitate a trusted company.
• Spear phishing. A message written for one person, using details about them.
• Business email compromise. An attacker poses as an owner, executive, or vendor and asks for a payment or a change in bank details.
• Pretexting. The attacker invents a story, such as “I’m from IT and need your password to fix your account.”
• Vishing. The same tricks by phone call.
• Smishing. The same tricks by text message.
• Baiting. A free download or a USB drive left where someone will find it.
• Tailgating. Following an employee through a locked door.

Why is phishing the biggest threat?

Phishing is the most damaging and widespread threat facing small businesses. Industry analyses attribute the large majority of breaches to it, with business losses in the billions of dollars.

Malware attacks follow, a category that includes ransomware. Malware can disable devices or leak confidential data. That is expensive to fix, and it harms the company in ways that go beyond equipment and cleanup costs.

Why does social engineering work?

It works because it uses normal human reactions.

• Authority. We follow requests from a boss or an official.
• Urgency. A deadline stops us from thinking.
• Fear. A threat to an account or a job pushes us to act.
• Helpfulness. Most people want to assist a coworker or a customer.
• Curiosity. An unexpected file or link is tempting.
• Familiarity. A message that mentions real names and details feels safe.

None of this requires expensive or complex tools. An attacker needs a convincing story and an email address.

What does a real attack look like?

1. The attacker reads your website and social media to learn names and roles.
2. They send an email that appears to come from a vendor, with an “updated invoice” attached.
3. An employee opens it. Malware installs, or a fake login page captures a password.
4. The attacker reads email quietly and learns how you handle payments.
5. They send a payment request at the right moment, or they lock your files with ransomware.

Depending on the malware, security software may or may not catch the file. The person who received the email was the first and best chance to stop it.

How long before a business notices?

Often a long time. Reports indicate that outside parties, such as a bank, a customer, or law enforcement, discover most social engineering and phishing incidents. The business itself does not realize it is a victim.

How do I spot a social engineering attempt?

• The request is unexpected
• It pushes you to act fast or in secret
• It asks for a password, a code, or a payment
• It asks you to skip a normal process
• The sender’s address or phone number is slightly wrong
• Something about the tone feels off

When you notice any of these, stop, and verify through another channel.

What is the best defense?

Training. Technology keeps advancing, and new tools reach the market fast. Those tools are only as effective as the people who use them.

Raising security awareness through training pays back sooner than most investments, because staff come to understand both their tools and the threats.

• Train everyone, including owners and executives
• Use real examples from your own industry
• Run simulated phishing tests and teach from the results
• Repeat through the year

What technical controls help?

• Multi-factor authentication, so a stolen password is not enough
• Email filtering and warnings on messages from outside the company
• Limited access, so one compromised account can’t reach everything
• Security software and automatic updates
• Tested backups

What rule stops the most fraud?

Verify by phone. Any request to send money, change bank details, buy gift cards, or share employee records gets a call to a number you already have. This one habit blocks most business email compromise.

How do I build a security culture?

Cybersecurity is a community effort and a cultural approach. A hacker needs to succeed once. Your team needs to stay alert together.

• Thank people who report suspicious messages
• Treat mistakes as lessons
• Talk about security in regular meetings
• Lead by example

What should I do if an employee falls for it?

1. Disconnect the device from the network.
2. Change the affected passwords from another device.
3. Call your bank if money is involved.
4. Bring in your IT or security provider to check for further access.
5. Report it to the FBI at ic3.gov.
6. Share what happened with the team, without blame.

Your next step

Ask yourself how your team would respond to a fake invoice email tomorrow. If you aren’t sure, start with training. Get in touch with our team to learn how Cerberus Cybersecurity can help you defend against cybercriminals with cybersecurity training built for your staff. Contact us today. At Cerberus Cybersecurity, we are people first.