Threat profile
Social engineering and payment fraud
Manipulating people rather than systems: a fake executive, supplier or support agent persuades someone to move money or reveal access.
How it works
The attacker researches an organisation, then writes or phones as someone with authority. A common form is business e-mail compromise: a supplier appears to change its bank account, or an executive asks for an urgent transfer. No malware is needed; the weakness is a process that lets one person approve a payment alone.
What to look for
- A change of bank details sent only by e-mail.
- Secrecy: "do not tell anyone" or "I am in a meeting, only write to me".
- A call that asks for a code you just received by SMS.
- An unusual amount, timing or recipient for the sender.
What reduces the risk
- Confirm payment or bank-detail changes through a second channel, using a number you already hold.
- Require two approvers above a set amount.
- Never read out one-time codes; no genuine bank or agency asks for them.
- Train staff with real examples and make reporting easy and blame-free.
Sources
Related threats
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).