The book ‘Fraud Detection and Prevention Methods in Banking’, prepared by the Banks Association of Turkey (TBB) on fraud prevention and made available to banks, aims to analyze the types of fraud that threaten the banking and finance sector and individuals, assess them from the sector's perspective, and provide information on protection recommendations with examples from the world and from Turkey.
In this context, the framework of security vulnerabilities as a whole is outlined; fraud methods and types encountered in Turkey and around the world are covered; and, through analysis and case scenarios, methods of protection against fraud that banks and individuals can consider in the coming period are presented.
All social engineering methods are built on biases in human behavior. It would not be wrong to call these biases human "system vulnerabilities". Biases steer human behavior in social and economic decisions. Factors such as the complexity of the task, uncertainty, time constraints, focus and being a target, belief, pressure effects, herd psychology, the empathy effect, how information is presented and selective perception trigger these biases. The social engineer gains an advantage by using methods that activate these biases in human behavior.
“The biggest danger to an organization's security is not a missing update in a key program or a badly installed security application. In reality, the biggest danger may be you. Personally, I have found that deceiving people is easier than deceiving technology. Most organizations overlook the human factor.” (Kevin Mitnick)
Biases and human behavior:
- The feeling of winning (messages saying you have won a prize…)
- Fear of authority (we are calling from the police, you sent a threatening message…)
- The desire to help (we would give our lives for our country, immediately…)
- Fear of loss (this opportunity is offered for today only…)
- Laziness (if you cannot come to the branch for your transactions, let us do it right here, do not trouble yourself…)
- The desire to be valued; ego (we are doing business with a valuable employee like you, may I have your personal number?)
- Insufficient knowledge (what could happen if I give my card number?)
- Making promises (we will cover your credit card annual fee and loan file costs…)Social engineering is the set of methods and organizations aimed at obtaining information and materials belonging to individuals and institutions (physical and system environments, organizational structures, user codes and passwords, working conditions, workflows, security organization, etc.), with or without technology, in order to gain an unfair advantage. The basis of social engineering is in fact deceiving people.A social engineering case refers to the entire process, including the unfair gain obtained, from the moment the information is obtained.
The relevant document can be accessed at the link below:
