Social Engineering Community

Social Engineering Community (SEC) village

[Social Engineering Community @sec_defcon]

Our schedule is live!

https://t.co/rkH2yoU236

[Social Engineering Community @sec_defcon]

⏱️ SEC in 60: The power of a pause.

“Need this NOW.”
“Don't tell anyone.”
“We can't wait for approval.”

Pressure is part of the playbook.

Before acting, ask: Is this normal? Can I verify it? Why the rush?

A few seconds of thought can interrupt a very convincing pretext.

[Social Engineering Community @sec_defcon]

A confident voice, a fancy title, and the phrase “leadership needs this ASAP.”

Suddenly, nobody wants to ask questions. 👀

Authority is a powerful social engineering tool.

What's the most effective way you've seen someone appear authoritative without actually having authority?

[Social Engineering Community @sec_defcon]

Friday question for the social engineering crowd:

What's the smallest detail you've seen make a pretext feel believable?

A name? An internal acronym? The right timing?

Sometimes the tiniest details do the heaviest lifting. 👀

[Social Engineering Community @sec_defcon]

What makes someone seem trustworthy?

A confident voice?
A familiar name?
An official-looking badge?
Knowing details they shouldn't?

Social engineers know how to borrow credibility.

Which one do you think people fall for most often? 👀

[Social Engineering Community @sec_defcon]

Your EDR is humming. Your badge readers are working.

Meanwhile, attackers are looking for the gap between them. 👀

SEC co-founder Snow explores where cyberattacks become physical breaches in her latest article for Security Today.

🔗 https://t.co/qvHrbUBtcQ

[Social Engineering Community @sec_defcon]

⏱️ SEC in 60: The callback rule.

Someone calls claiming to be IT, your bank, or your boss?

Don't trust caller ID alone. It can be spoofed.

Hang up. Find the official number yourself. Call back.

A familiar number isn't proof of a familiar caller.

[Social Engineering Community @sec_defcon]

Hot take: Familiarity isn't verification.

Knowing someone's name, job title, and manager doesn't make you trustworthy.

It makes you someone who knows how to use LinkedIn. 👀

What's the most convincing way you've seen someone fake credibility?

[Social Engineering Community @sec_defcon]

🎃 The scariest disguises aren't always Halloween costumes.

Sometimes they're fake IT calls, phishing emails, or convincing DMs. 👻

Cybersecurity Awareness Month may be ending, but we're just getting started.

Happy Halloween from SEC! 💜

#CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

They know your name.
Your company.
Even your boss.

Cool. So does LinkedIn. 👀

Knowing details about you doesn't prove someone's identity.

SEC in 60 tip: Verify unexpected requests through a trusted channel.

#SECin60 #CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

Oops. You clicked it. 👀

Don't panic.

🛑 Stop interacting
📣 Report it to IT/security
🔐 Entered credentials? Secure your account through the real site
💻 Downloaded something? Follow your security team's guidance

Fast reporting beats silent panic

#CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

📞 Caller ID: IT Help Desk

They know your name and company. Then they ask you to read back a verification code.

🚩Caller ID can be spoofed.

Never share unexpected sign-in codes. Hang up and verify through a trusted channel.

Would you fall for it?

#CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

Your privacy settings called. 📱

They miss you. 👀

SEC in 60 challenge:

⏱️ Who can see your posts?
🏷️ Who can tag you?
🔎 What's visible to strangers?

Take a minute to check. You might be surprised.

#SECin60 #CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

New job. ✨
Vacation countdown. ✈️
Work badge selfie. 📸

Individually? Small details.

Together? A pretty good picture.

Your public profile might be telling strangers more than you think.

Take 60 seconds to review what you're sharing. 👀

#CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

Free Wi-Fi? 👀

You scan a QR code at a coffee shop. Suddenly, it wants your email and password.

Still connecting?

QR codes aren't the problem. Untrusted destinations are.

Check the URL. Verify the source.

Would you have scanned it?

#CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

Not every red flag is red. 🚩

Sometimes social engineering looks like someone being REALLY helpful.

Unexpected offer to fix a problem? Great. Just verify who you're talking to before sharing info or access.

SEC in 60 ⏱️

#CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

🚨 URGENT! ACT NOW!

Sound familiar?

Social engineers use urgency to make you react instead of think.

Real emergencies happen, too. That's why verification matters.

Pause. Question. Verify.

What's the wildest "urgent" request you've received?

#CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

Your boss needs a favor. ASAP.

They're in a meeting. Can't talk. Details coming soon.

Normal Tuesday or social engineering attempt? 👀

Welcome to "Would You Fall for This?"

Spot the red flags. What's your next move?

#CybersecurityAwarenessMonth

[Social Engineering Community @sec_defcon]

@sec_kc @_seash @AntlerSec @defcon @hevnsnt 🔥🔥🔥

[Social Engineering Community @sec_defcon]

It’s Cybersecurity Awareness Month 👀

Your security stack has something that firewalls, EDR, and MFA don’t cover:

People.

Give them the knowledge and permission to stop, question, and verify.

What’s one security habit you wish everyone practiced?

#CybersecurityAwarenessMonth

[Lexi S @alilbitl3xis]

@defcon what a whirlwind! Competed in @sec_defcon vishing comp & got a dundee 🏆✅ survived volunteering at @sec_defcon IYKYK ✅ BSB at the Sphere w/ my girlz ✅ Met cool ass ppl like @rekdt & @JackRhysider ✅ Watched hubby on award stage after winning a badge 2nd yr in a row for @phishstories contest 🏆 ✅ Felt post con sadness after returning home 😭✅ Until next year.... ☮️✌🏼🫶🏼🫰🏼