The "Social Engineering" of Internet Fraud
Jonathan J. Rusch · 2003
Many online media have recently been focusing on the topic of Internet fraud. Business leaders, computer security experts, and lawyers, however, do not fully understand the kinds of frauds that can be conducted through or with the aid of the Internet, or the ramifications of such frauds for the future of e-commerce. This paper has three principal goals. First, it will identify the principal types of Internet frauds that law enforcement and regulatory authorities are observing. Second, it will explain the major psychological influence techniques that criminals use in conducting such frauds (including the similarities between those techniques and engineering techniques of hackers). Third, it will propose some responses to the problem involving both government and the private sector. The paper will begin by presenting a typology of the major forms of Internet fraud, referring not only to the type of crime each form involves but also to the nature of the deception -- whether deception of computer systems (e.g., packet sniffing and data harvesting) or of individuals (e.g., securities and other investment schemes) -- and the manner in which the criminal can obtain the victim's funds. It will then explore the principal psychological features of Internet fraud, particularly the commonalities between various types of fraud, through both the academic literature of social psychology and real-world examples. It will explore the attitudes and beliefs of criminal and victim about each other and about the medium of the Internet, to clarify the broader context in which fraud can occur. It will also discuss the principal social psychological influences that the criminal brings to bear on the victim (i.e., authority, commitment and consistency, liking and similarity, reciprocity, scarcity, and social proof), and why those influences operate so powerfully to persuade the victim to part with something of value. It will also note the typical types of hardware and software that are meant to provide online consumers with security, while noting those aspects of online behavior that limit the effectiveness of those measures. Finally, it will propose new methods for addressing the psychology of online fraud in prevention and education methods as well as government enforcement measures, as part of a comprehensive approach to increasing consumer confidence in e commerce. This paper is likely to make two significant contributions to INET'99. First, it will expose business leaders, security professionals, policy makers, and lawyers to an aspect of e -commerce and to relevant bodies of knowledge and experience with which they are certain to be unfamiliar. Second, it can help industry professionals to understand the limitations of hardware and software in providing a truly secure environment for e -commerce, and to begin to think with greater clarity and precision about what else can be done to develop truly comprehensive means of fostering that environment.