Social Engineering: How Scammers Manipulate People into Sending Them Money

Social engineering is a form of manipulation that tricks people into giving scammers their money, SMS verification codes or card details. The National Bank of Ukraine and the Cyber Police identify social engineering as one of the most common causes of payment card fraud. In this article, I’ll explain how these scams work and at what point you should simply end a conversation with someone claiming to be a bank employee.

When most people think about stolen banking details or money disappearing from an account, they picture a hacker sitting in front of multiple monitors. Forget that image! Many of these crimes are committed not by hackers but by people who know exactly how to manipulate others through conversation.

Social engineering exploits fear, trust, greed and urgency. Scammers are not looking for vulnerabilities in a bank’s security systems. They are looking for the moment when you act before you have time to think.

What does social engineering fraud look like in practice? The scenario is almost always the same:

1. Research. Your name, phone number and the bank you use — scammers obtain this information from data breaches, online advertisements and social media.
2. Contact. A phone call, SMS or message supposedly from a bank, the police or a security department.
3. Pressure. “Your money will disappear in five minutes” or “Someone is taking out a loan in your name.”
4. Action. You reveal a verification code, click a link, install software or transfer money.

In banking, social engineering usually involves several common techniques:

• Vishing — a fraudulent phone call. Someone claiming to be a bank employee informs you about a suspicious transaction.
• Smishing — an SMS containing a link or a phone number you are supposedly required to call.
• Phishing — a fake website designed to look like your bank’s website. Scammers immediately capture the login credentials and passwords you enter.
• Messaging apps. You are added to a fake “support group” on Telegram or Viber. Unex Bank explicitly warns about these scams in its security section.
• Compensation payments and prizes. “You have been awarded compensation” — all you need to do is enter your card details.
• Remote access. You are asked to install AnyDesk or TeamViewer “to protect your smartphone”. In reality, this can give scammers extensive control over your device, including access to SMS messages.

There are four main psychological triggers: urgency, fear, trust and the promise of financial gain.

Urgency prevents you from checking the facts. Fear undermines critical thinking. Trust is created through impressive-sounding titles such as “Security Department” and the scammer’s knowledge of your personal information. The promise of financial gain works on people who are less easily frightened.

Scammers usually combine these techniques: first they create fear, then they offer a “solution”.

A classic example is the “safe account” scam. Someone claiming to be from the bank’s security department calls and says that another person is trying to withdraw your money. They urgently recommend transferring your funds to a “protected” account.

You do everything yourself: open your banking app, enter the payment details and authorise the transfer. From the bank’s perspective, this appears to be an ordinary transfer initiated by the customer. That is exactly what the scammers are counting on.

The second scenario involves a verification code. “Tell me the code from the SMS so I can cancel the transaction.” In reality, the code may be what authorises the withdrawal.

The third scenario involves remote access. Once you install the requested software, scammers can initiate payments through your banking app and see SMS messages displayed on your screen.

Payment card fraud rarely starts with the card itself. It starts with a conversation in which you believe you are protecting your own money.

Let’s look at the most common scams.

There is information you must never share with anyone, even someone claiming to be a bank employee: your CVV2/CVC2, card expiry date, PIN, SMS verification codes and online banking password.

Another important question is how to check your bank card for fraudulent activity. There are three ways:

• Enable SMS transaction notifications.
• Regularly review your transaction history in the banking app.
• Set transaction limits.

If you notice a transaction you did not make, contact your bank immediately!

Here is a quick guide on what to do if scammers have withdrawn money from your card or obtained your card details. Every minute matters, so you need to act quickly.

Follow these steps:

1. Block your card through your banking app or online banking.
2. Call your bank. The phone number is printed on the back of your card and is also available in the banking app or on the bank’s official website. For Unex Bank, call 0 800 3 111 33.
3. If remote-access software has been installed on your phone, disconnect it from the internet, remove the software, restart your phone if necessary, and then contact your bank.
4. Change your online banking and email passwords.
5. Report the incident to the police: submit an online report to the Cyber Police or call 102.
6. Preserve evidence, including screenshots of conversations, phone numbers, call times and bank statements.

After blocking your card and reporting the incident, the next question is usually whether the bank can recover the stolen money.

There is no universal answer. It depends on the type of transaction (card payment, bank transfer or cash withdrawal), who authorised it and how, the payment network’s rules and the circumstances of the fraud.

Ukraine’s Law “On Payment Services” requires users to notify their bank immediately about unauthorised payment transactions. That is why it is important to act without delay, ensure your complaint is officially recorded and provide the bank with all available evidence: bank statements, SMS messages, screenshots of conversations and any other materials related to the incident. The bank reviews each case individually, and whether the money can be recovered depends on the specific circumstances and applicable legislation.

If you personally authorised the transfer or disclosed a verification code to scammers, recovering the money may be more difficult. However, this does not mean contacting the bank is pointless. Ask the bank to register your complaint and inform you of the outcome of its investigation.

If the bank refuses to refund the money:

1. Request a written response explaining the reasons for the refusal.
2. Submit a complaint to the National Bank of Ukraine, attaching the bank’s response and evidence of the fraud.
3. If there are indications of a criminal offence, file a report with the police or Cyber Police.

Important: Filing a complaint with the NBU does not, by itself, guarantee that your money will be recovered. 

When it comes to protecting yourself from social engineering, the most important defence is simple: pause before acting. Scammers succeed when you are in a hurry. Here are some practical habits that can help:

• Use a separate card for online payments, set daily transaction limits and enable 3D Secure.
• Enable online transactions only when you are about to make a payment.
• Avoid publicly sharing the phone number linked to your bank account.
• Install apps only from the App Store or Google Play, and check the permissions they request.

Tell your family about these scams, especially older relatives — scammers use the same tactics when targeting them!

Social engineering relies on trust, fear and urgency. But you can disrupt a scammer’s plans simply by refusing to act under pressure. 

Translation into English was created with the help of artificial intelligence.