CompTIA A+ Certification All-in-One Exam Guide

NOTE Social engineering attacks are often used together, so if you
discover one of them being used against your organization, it’s a good idea to
look for others.
Infiltration
Hackers can use impersonation to enter your building physically disguised as
cleaning personnel, repair technicians, messengers, and so on. They then
snoop around desks, looking for whatever they can find. They might talk with
people inside the organization, gathering names, office numbers, department
names—little things in and of themselves, but powerful tools when combined
later with other social engineering attacks.
Dressing the part of a legitimate user—with fake badge and everything—
enables malicious people to gain access to locations and thus potentially your
data. Following someone through the door, for example, as if you belong, is
called tailgating. Tailgating is a common form of infiltration.
To combat tailgating, facilities often install a mantrap at the entrance to
sensitive areas, or sometimes at the entrance to the whole building. A
mantrap is a small room with a set of two doors, one to the outside, unsecured
area and one to the inner, secure area. When walking through the mantrap,
the outer door must be closed before the inner door can be opened. In
addition to the double doors, the user must present some form of
authentication. For additional security, a mantrap is often controlled by a
security guard who keeps an entry control roster. This document keeps a
record of all comings and goings from the building.
Telephone Scams
Telephone scams are probably the most common social engineering attack. In
this case, the attacker makes a phone call to someone in the organization to
gain information. The attacker attempts to come across as someone inside the
organization and uses this to get the desired information. Probably the most
famous of these scams is the “I forgot my user name and password” scam. In