“Would a scammer have a supervisor?” a victim asked Bruce Schneier after a caller claiming to be from a major bank recited a comforting corporate mantra and then immediately violated it — asking for codes and remote access. That question points to the heart of the problem: social engineering isn’t a technology failing so much as a human dilemma — we are built to trust authority, procedure and small signals of legitimacy, and modern scammers have learned how to imitate them with surgical precision.
Over the past several years investigators have traced waves of text- and call-based fraud to organized gangs that exploit everyday administrative anxieties: missed tolls, postage due notices, unpaid violations. The messages look official, the links or reply prompts feel easy — and a single moment of panic or haste can hand a criminal a credit-card number, a one-time password, or an app that gives persistent device access. In one recent account, groups operating from abroad used these techniques to turn stolen payment data into consumer goods and gift cards, producing large-scale losses that ripple well beyond individual victims.
Background: the old tricks, turbocharged
Impersonation, urgency and fabricated authority are not new: con artists have long relied on scripts that press people to act before they can think. What has changed is scale and supply. Data breaches, public databases, and social media supply rich details that make impersonations far more convincing. Cheap telecom and messaging infrastructure enables mass delivery of spoofed calls and texts. Off-the-shelf remote-access and fraud-enablement tools let attackers complete thefts quickly, sometimes within minutes of first contact. The Schneier recounting of a phone scam — where the caller provided “cancellation codes” and offered a transfer to a “supervisor” — illustrates the hybrid script-and-technology model of modern social engineering.
What the current situation looks like
Scammers typically follow a compact, repeatable sequence: an alarming initial contact (a fraud alert; overdue payment), the provision of pseudo-official details (case or confirmation numbers), escalation to someone presented as higher-authority, and a set of concrete, urgent instructions designed to extract codes, install remote-control software, or authorize a transaction. Victims who comply often believe they are following legitimate procedures; that belief is the exploit. These attacks generate direct financial loss, long reclamation processes, and downstream costs for banks and payment platforms that must investigate and reimburse victims.
Why this matters
Beyond individual losses, social-engineering fraud erodes public trust in remote and digital channels — the very channels that modern commerce relies upon. Financial institutions face rising operational burdens; regulators and policymakers confront jurisdictional limits when criminal organizations operate from countries where takedowns and prosecutions are slow or impossible. And because the vulnerability being exploited is a human one, the remedy cannot be a software patch alone.
Perspectives to consider
Technologists: Recommend layered defenses. Phishing-resistant multi-factor authentication (hardware tokens, FIDO/WebAuthn) and transaction signing that requires a user-initiated in-app confirmation blunt many social-engineering outcomes. Telecoms can deploy and improve caller-ID authentication frameworks and spoof-detection heuristics to reduce the plausibility of fake calls and texts.
Policymakers and law enforcement: Must weigh domestic protections (clear reimbursement rules, mandated verification standards for financial actions) against the need for cross-border cooperation. Many successful fraud rings exploit international boundaries; coordinated takedowns, shared intelligence, and focused legal tools are essential to disrupt infrastructure and the payment pipelines that make criminal conversion possible.
Users: Face the hardest burden — changing small but critical habits under stress. Public awareness campaigns help, but they must be paired with institutional changes so ordinary verification rituals are quick and reliable rather than onerous.
Adversaries: Optimize for speed and believability. Scripts are rehearsed; personal data is weaponized to personalize outreach; social proof — case numbers, hierarchy cues, official phrasing — is used to short-circuit doubt. The faster and more credible the interaction, the higher the success rate.
Practical, evidence-based steps that work
- Never share one-time passwords or authentication codes in response to an unsolicited call or text. Legitimate institutions will not ask for them that way.
- If contacted unexpectedly, hang up and call back using a verified number from the organization’s official website or the number on the back of your card. Don’t use numbers provided in the suspicious message.
- Refuse remote-access requests from unknown callers. If remote troubleshooting is truly required, arrange the session through the verified customer portal or in-branch support.
- Use phishing-resistant MFA (hardware security keys or platform/WebAuthn) where available to reduce the value of stolen credentials and one-time codes.
- Monitor card and bank statements frequently and enable transaction alerts that require you to approve unfamiliar charges. Quick detection shrinks attackers’ windows to monetize stolen data.
- Institutions should redesign critical workflows so high-risk actions require user-initiated confirmations within an authenticated channel, not through agent-led phone steps. This removes the script-driven vectors scammers exploit.
What institutions can do that individuals cannot
Banks, card networks and payment processors must make it routine that the consumer — not a phone agent — triggers approvals for high-value or unusual actions. Telecom carriers and messaging platforms must accelerate anti-spoofing rollouts and label high-risk traffic. Regulators should require clearer protocols for how organizations communicate urgent requests and should streamline reimbursement standards so victims aren’t stuck in multi-week reimbursement fights. Finally, international law enforcement cooperation needs to be faster and more tactical: take down the call centers and payment funnels quickly, then follow the money.
Case in point: the ritual that wins
The simplest, most reliable defense is also the least glamorous: treat any unsolicited call demanding codes, installations, or account actions as suspect; end the call and initiate a callback on a trusted channel. It’s a ritual that restores control and imposes a friction scammers bank on avoiding. As the Schneier example shows, plausible cues — a case number, the promise of a supervisor, a corporate tone — can convert reasonable skepticism into compliance. Changing the environment so those cues mean less is the policy and design challenge ahead.
Conclusion
Social engineering will not vanish while people answer phones and read texts. But the balance of advantage can shift away from scammers if institutions design systems that default to user control, if telecoms reduce spoofing, and if users adopt a few simple rituals that buy time for verification. Otherwise, we will continue to let hurried certainty and a believable script determine who gets to spend our money. In a world where a few words on a screen can cost us hundreds or thousands, are we willing to accept the convenience of immediate reply at the price of our financial defenses?
Source: https://www.schneier.com/blog/archives/2025/10/social-engineering-peoples-credit-card-details.html
