The Anatomy of a Social Engineering Scam

Click here to view/listen to our blogcast.

When people think of cybercrime, their minds often jump to firewalls, ransomware, or data breaches. But one of the most common – and devastating – forms of attack doesn’t involve any hacking at all. It simply relies on tricking someone into trusting the wrong person.

Here’s the real story of how a small architectural firm got caught in a scam that cost a new hire $1,000 – and what your business can do to avoid the same fate. (All names have been changed to protect the victims.)

The Setting: A Growing Team at a Small Architectural Firm

“Blueprint Studio” is a small but thriving architectural firm with a team of 14. Jane, the firm’s founder and lead architect, also oversees operations and IT – common for small businesses where leadership wears many hats. She manages the firm’s Google Workspace account and handles basic technology needs.

Recently, Jane hired a new executive assistant named Jack. Jack’s role was to support Jane and assist with general office tasks. To welcome him aboard, Jane posted a short “Meet Jack!” announcement on her LinkedIn profile.

That well-intentioned post was all a scammer needed to set their trap.

The Attack Begins

Just three days after the LinkedIn post went up, Jack received an email that appeared to come from Jane. It said: “Hi Jack, I’m currently out of the office. Can you text me your cell number real quick? I need your help with something.”

Believing it was his new boss, Jack complied. Moments later, he received a text message from a number he didn’t recognize – but it signed off as “Jane.”

“I want to do something nice for the team and surprise a few employees with gift cards. Can you grab some while you’re out? I’ll reimburse you.”

Jack, eager to help and still new to the team, rushed to a nearby pharmacy and purchased five $200 gift cards using his own money. He texted back that he had the cards and was on his way to the office.

The Hook – and the Loss

That’s when the fake Jane texted again: “Still not in the office. Can you go ahead and activate them and send me photos of the codes? I need to get these out right away.”

Jack, still thinking he was being helpful, followed the instructions. He scratched the cards, took photos, and sent them via a message using his smartphone.

By the time he walked into the office and saw the real Jane at her desk, it was too late.

Jane hadn’t sent the email. She hadn’t sent the texts. And the cell number wasn’t hers. Jack had just been socially engineered – and he was now personally out $1,000!

How It Happened

This wasn’t a high – tech hack. It was a con job. Here’s how the attacker pulled it off:

• Used a real LinkedIn post to learn about a new hire
• Impersonated authority using Jack’s name and position
• Created urgency to bypass normal skepticism
• Appealed to helpfulness – a common trait in new employees

Lessons for Every Business

Even a tiny medical office can be the target of a scam. Here’s how your business can avoid the same mistake:

• Train every new hire on day one
  Make social engineering and phishing awareness part of onboarding. Teach them to question out – of – band requests.
• Verify before you act
  If something feels off – even slightly – pause and verify using a known contact method (not the one that reached out to you).
• Don’t use personal communication for work transactions
  Stick to company – approved platforms (like Microsoft Teams or Slack) for internal requests – especially financial ones.
• Use anti – spoofing tools
  Ensure your domain is protected by SPF, DKIM, and DMARC to help prevent email impersonation.
• Limit details on public social media
  Welcome new hires internally. If you post publicly, leave out full names and job responsibilities.

Final Thoughts

Social engineering scams like this are disturbingly effective because they prey on trust, confusion, and a desire to do the right thing. Jane wasn’t careless – she was targeted. And it could happen to anyone.

At CDML, we help small and midsize businesses build smarter, safer workplaces through security training, email protections, and simple policies that make a big difference. If your team isn’t trained – or if you’re not sure where your weak spots are – now’s the time to act.

Need help preventing scams like this? Schedule a security review or contact us today.

Stay safe. Stay informed.

📞 Contact us here: https://cdml.com/contact/
📚 Read more on our blog: https://cdml.com/blog  –  2
📺 Listen to our blogcasts: https://www.youtube.com/@CDMLComputerServices