# A Study on the Psychology of Social Engineering-Based Cyberattacks and Existing Countermeasures
## 1 Introduction  
At present, the digital world is growing at an exponential rate. People are embracing the internet as a new way of communication, business, knowledge, and entertainment. However, this shift in paradigm is raising serious concerns for the online security and privacy of users. Despite rigid security measures, a high number of internet attacks are conducted by exploiting application design vulnerabilities, scamming, or advanced technical methods [1, 2]. Among these attack methods, scamming has been around even before the existence of computers and the internet. In terms of cybersecurity, scamming or phishing are categorized as social engineering (SE) attacks. Attacks that involve exploiting human vulnerabilities are classified as SE attacks [3]. SE attacks are conducted by exploiting human vulnerabilities, such as deception, persuasion, manipulation, or influence [4]. The mentioned vulnerabilities are exploited to acquire confidential information, unauthorized access, knowledge of cybersecurity measures, etc. The main concern for security experts in countering SE-based attacks is the absence of a pattern or methodology. In some cases, even the target is unaware that they are being manipulated or influenced by the perpetrator. Due to such hazy characteristics of SE-based attacks, existing countermeasures struggle to stop such attacks. Recently, there were several large-scale security breaches, compromising the vulnerable human factor [5, 6, 7]. Despite the advancements in technology, humans play an integral part in functional organization. This human element in the organizational security chain is inevitably targeted and exploited by hackers. Figure 1 shows some of the most common tools and a basic flow of cyberattacks based on SE [8, 9]. In the last two years, the most prominent mediums used to conduct SE attacks were social media and smishing attacks. The majority of cyberattacks based on SE rely on actual interactions between the attacker and the victim. In some cases, SE attacks can involve a simple phone call, with an individual impersonating an employee to garner information, such as a password or a PIN code. In 2020, Americans lost approximately USD 29.8 billion in phone scams [10]. Table 1 provides a broad overview of attacks based on SE methods. The attacks highlighted in Table 1 are some of the most prominent breaches in the last few years. These breaches occurred due to a combination of human errors and SE attacks. Based on Table 1, it can be seen that human error can also play a key role in conducting SE attacks. To conduct SE attacks, hackers can even influence a victim into making an error. Common methods used to influence targets are discussed later in the paper. Other than the financial costs, data breaches can also lead to the loss of customers due to security concerns. These attacks are highly impactful and easy to conduct. Based on the studies conducted for this work, as well as our understanding, the countermeasures for SE-based attacks lack the understanding of human behavior. Few of the published works highlight the interconnection between human vulnerabilities and SE attacks. This study further enhances the existing knowledge of human behavioral vulnerabilities and how they are exploited by hackers. After highlighting the importance and impact of cyberattacks based on SE, the rest of the paper is organized as follows. Section 2 provides a brief overview of well-known cyberattacks based on SE and how they are conducted. Section 3 provides a perspective on common human emotions or errors that can be exploited to conduct SE attacks. The section also presents the current standings and concerns of machine learning (ML) and existing countermeasures against SE-based cyberattacks. Section 4 highlights the concerns of existing solutions, including a summary of the topics discussed in this paper. Section 5 concludes the paper.