How to Rob a Bank over the Phone - Lessons Learned from an Actual Social Engineering Engagement
summary
A red team recreates a real social‑engineering engagement using recorded audio and recon shows an ISP outage lever to pose as QA, then uses four staged calls, a PowerShell fallback after antivirus detection and a VirusTotal mistake to gain credentials — at one point achieving domain admin over the phone and later compromising every workstation during a Monday visit, photographing cash (verified selfie from the vault). Metrics show over 950 low‑risk users, developers ranked second and sales 380% more likely to click, so defenses focus on vendor passphrases, high‑frequency targeted training and short, need‑based exercises.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 2:40Recon
- 8:09Mistake
- 9:29Never give up
- 10:38Multiple calls
- 12:21My boss rule
- 14:21We do social engineering
- 14:56Sound effects
- 18:41Who hired me
- 19:29Tips for social engineering
- 22:05Giving instructions
- 23:36Pre pretexting
- 27:26Your Biggest Risk
- 27:57Your Users
- 28:57Sales and Developers
- 29:52Attention Span
- 30:02Social Media Rules
- 30:13Short Touch Points
- 30:24Boring Training
- 31:06Training Video Example
- 32:27High Frequency Education
- 32:54Train According to Need
- 34:22Integrate Everywhere
- 35:24Timing
- 42:04Cultural Differences
- 42:55Personal Assistants
- 45:15Guards Up
- 46:08Social Engineering
related talks
56mHacking your Mind and Emotions
49mStories from the trenches - How a red team exercise gained full control of a client network
58mHow I used to rob banks!
44mHacking Humans: Social Engineering Techniques
55mSocial Engineering Overview-How To Prevent Your Co. from Getting Hacked
16mSocial Engineering: Tactics and Techniques
51mSocial Engineering: Hacking People
01h 03mSocial engineering pentesting. - How it is done, and what you should think about