# Phishing Attacks Survey: Types, Vectors, and Technical Approaches
## 3 Phishing Methods and Techniques
### Phishing Technical Approaches
#### 3.3.7 Social Engineering  
Social engineering is the manipulation of a person or persons to reach an objective by abusing the victim's emotions, gullibility, charity, or trust [50]. Social engineering is one of the oldest techniques available to phishers and the hacking community at large. An early example is the Greek myth of the trojan horse, which could be called an ingenious piece of social engineering. Because it requires no specific medium or vector, it is one of the most versatile technical approaches. It has been defined as \"the art and science of getting people to comply with your wishes\" [51] and has no singular technical defensive strategy [52]. Social engineering skills can be categorized as demonstrated by [PERSON] et al. ; for example [52]:  
* Impersonating staff--fundamental to social engineering because appearing in a position of power increases the odds of the victim falling for the manipulation; for example, a victim is more likely to share their password with an IT employee than to a random stranger. * Hoaxing--convincing the victim that something untrue is true. Often leading to action out of fear. * Creating confusion--an attacker can create confusion to obtain the information they seek, especially in physical situations; for example, setting off a fire alarm may cause people to leave their PCs unlocked and unattended, providing the attacker with access. * Reverse social engineering--this is the most subversive method of social engineering, involving significant effort to set up and plan. As a result, the attacker appears to be in a position of power or authority, and thus victims approach them to ask questions and willingly provide their personal details. The overall goal of a social engineering attack is to prevent the target from acting rationally and to instead rely on emotions that can be manipulated. This includes emotions such as:  
* Greed
* Fear
* Anger
* Patriotism
* Friendship
* Sense of duty
* Sense of belonging
* Sense of authority
* Philanthropy
* Vanity  
By utilizing these emotions and preventing the target from acting rationally, a phisher can manipulate a target into acting without proper consideration and thus yield personal details. Examples of these emotion-based attacks are the classic \"Nigerian Prince\" or \"You've won the lottery\" scams, which take advantage of potential targets' greed. These attacks attempt to manipulate the target by effectively bribing them using, for example, a story about a wealthy individual who has money he wishes to transfer and for which he requires assistance. In return for providing this help, the victim is promised substantial compensation, but only after the victim provides something to the \"wealthy individual\", such as a small payment or bank account number, physical address, etc., so that a background check can be performed. The victim's greed for the large sum of money they have been promised compels them to do the phisher's biding. This approach can be combined with the methods outlined in Section 3.3.1 regarding scarcity--that is, if the victim doesn't act then the rich individual \"will find someone else who will\"--thus potentially further clouding the victim's judgement and causing them to act rashly. Sense of duty and belonging is another emotion that can be easily manipulated. For example, if the victim is part of an online group, the phisher can pretend to also belong to the group. By insinuating that other members of the group have already taken part, the phisher can ask the victim to sign a partition or make a donation relating to a cause around which the group is based. This increases the likelihood that the victim will fall for the ploy because signing or donating will be seen as a duty of all members of the group. A third example is based on fear, particularly when a phisher impersonates an authority figure. A phisher, for example, may inform a victim that their account will be terminated while pretending to represent the group responsible for that account.