As Eswatini commemorates National Cybersecurity Awareness Month under the theme “Tivikele, Stay Safe Online,” we are reminded that protecting our digital world goes beyond installing antivirus software or setting strong passwords.
When we think of cyberattacks, we often picture complex coding, hacking into firewalls, or exploiting technical glitches. However, cybercriminals have discovered a far easier way into secure systems: manipulating people.
This tactic is known as social engineering—the art of psychological manipulation used to trick individuals into handing over confidential information, money, or access to secure networks. Instead of hacking the machine, criminals hack the human.
How Social Engineering Works in Everyday Life
Social engineers exploit basic human emotions: trust, fear, curiosity, urgency, and the desire to help. Here are everyday scenarios many Emaswati encounter:
1. Phishing via SMS or Email (The “Urgent Bank Notice”)
- The Scenario: You receive an SMS claiming your bank account or Mobile Money wallet has been suspended due to incomplete registration. The message instructs you to click a link urgently or dial a number to “verify” your details.
- The Trap: Panicked by the thought of losing access to your funds, you click the link, which leads to a fake webpage designed to steal your login credentials or PIN.
- Key Lesson & Tip: Real financial institutions will never ask for sensitive credentials via SMS links. Pause and verify: Open your official banking or Mobile Money app directly, or call the official customer care number—never use the contact details provided in the suspicious message.
2. Impersonation & Pretexting (The Service Support)
- The Scenario: You receive a call from someone claiming to represent a local mobile network provider and to be assisting the police with an investigation into phone numbers linked to “facata” scams. The caller instructs you to enter a code on your phone, claiming that it will clear your number from the investigation.
- The Trap: The caller sounds professional and authoritative, creating pressure to comply. By entering the code, you may be unknowingly sending money to the perpetrator.
- Key Lesson & Tip: Mobile network providers and the police will not ask you to dial or enter a code to clear yourself from an investigation. Verify the caller: End the call, then contact your mobile network provider directly using a verified telephone number or official email address before taking any action.
3. Baiting & Social Media Scams (The “Too-Good-To-Be-True Offer”)
- The Scenario: You see a Facebook or WhatsApp post promising guaranteed returns on a small investment, free airtime vouchers, or a luxury giveaway if you fill out a short survey with your personal details.
- The Trap: The promise of quick gain prompts you to share your full name, phone number, and national ID—data that scammers gather to impersonate you or compromise your accounts.
- Key Lesson & Tip: If an offer seems too good to be true, it almost certainly is. Protect your personal data: Refrain from filling out random online forms, and never trade personal identifiers for promised freebies or quick investment returns.
4. WhatsApp Account Hijacking (The “Accidental SMS Code”)
- The Scenario: You get a WhatsApp message from a friend or relative saying, “Hey! I accidentally sent a 6-digit verification code to your phone number by mistake. Could you please forward it back to me?” Shortly after, an SMS containing a verification code arrives on your phone.
- The Trap: Because the message comes from a familiar contact (whose account has likely already been hacked), you forward the code. The attacker immediately uses that code to log into your WhatsApp account on another device, locking you out and messaging your contacts for money.
- Key Lesson & Tip: A registration or verification code sent to your phone is for your eyes only. Never forward verification codes, passcodes, or One-Time PINs (OTPs) to anyone—even family or friends. Enable Two-Step Verification in your WhatsApp settings (Settings > Account > Two-Step Verification) to add an extra layer of protection with a personal PIN.
The Devastating Impact of Social Engineering
The fallout from a successful social engineering attack can be severe for both individuals and organizations:
- Financial Loss: Direct theft of personal savings, Mobile Money funds, or corporate bank accounts.
- Identity Theft: Stolen personal details can be used to open fraudulent accounts, take out loans, or execute crimes under your name.
- Corporate Breaches & Ransomware: A single employee clicking a malicious link can compromise an entire corporate infrastructure, resulting in operational downtime, loss of sensitive data, regulatory penalties, and reputational damage.
- Emotional Distress: Victims often suffer anxiety, stress, and embarrassment after falling prey to manipulation.
How to Protect Yourself: Practical Cyber Hygiene Tips
Under the banner of Tivikele, staying safe online requires building daily habits that shield you and your organization from deception.
Protecting Yourself at Work
- Verify Before You Trust: Always double-check requests for sensitive data, wire transfers, or system access through a secondary, verified communication channel (e.g., calling the sender directly using an official directory number).
- Never Share Your Passwords: Legitimate IT staff will never ask for your password, PIN, or multi-factor authentication (MFA) codes.
- Lock Your Workstation: Always lock your computer (Windows Key + L or Cmd + Ctrl + Q) when leaving your desk, even for a brief moment.
- Report Suspicious Activities: If you receive an unusual email or phone call, report it immediately to your internal IT/Cybersecurity team or focal point.
Protecting Yourself in Daily Life
- Pause Before Clicking: Never click on links in unsolicited SMS messages or emails. Go directly to official websites or apps instead.
- Beware of Artificial Urgency: Scammers rely on creating panic (“Your account will be closed in 1 hour!”). Whenever you feel rushed, pause and think critically.
- Secure Your Mobile Money & Mobile Banking: Never reveal your PIN to anyone—not even someone claiming to be a customer support representative.
- Practice Good Social Media Privacy: Avoid oversharing personal details (e.g., date of birth, location, or work badge photos) on public social media profiles that scammers can use to build trust.
Take Action This Cybersecurity Awareness Month
Security is a shared responsibility. You can equip yourself and your family with essential digital skills today:
- 🎓 Enrol in Free Cybersecurity Courses: https://tinyurl.com/FreeCybersecurityCourses26
- 📘 Download the Official Campaign Toolkit: https://tinyurl.com/CyberToolkit26
Tivikele — Do your part to secure our digital world!
Discussion about this post