Social engineering
A manipulation method where attackers exploit human trust rather than technical vulnerabilities.
Social engineering doesn't exploit technical flaws but human weaknesses: trust, helpfulness, time pressure, deference to authority. Classic examples: CEO fraud, fake tech-support calls, manufactured emergencies.
Protection: clear internal processes for sensitive actions (wire transfers, password resets) – and when in doubt, verify through the official phone number.
Why this matters in 2026
In 2026, Swiss SMEs are the prime target for CEO fraud: a spoofed "management" call with voice cloning triggers an urgent transfer. NCSC reports the average loss per incident at around CHF 80,000. Despite awareness campaigns, one in four attempts still succeeded in 2026 – almost always due to a missing four-eyes rule.
How to protect yourself
Clear internal processes: for every payment above CHF 5,000 apply the four-eyes rule – at least one second person must approve. On purported management calls with urgent requests: hang up and call back on the known internal number. Employee training with real examples is more effective than theory.