How Honeypot Scams Work, According to Security Experts

Shawnee Delaney often kicks off a training session by saying to a room full of company employees, “OK, raise your hand if you’ve ever received a flattering message on LinkedIn simply complimenting your background, profile, and experience.”

“Every hand goes up,” she said. Next, she explains to participants how responding to a simple message of adulation could unintentionally open the door to a potential romance scam.

Delaney is a corporate security expert, accustomed to teaching people how to avoid “honeypot” schemes, in which a bad actor uses romantic or sexual interest to build trust and gain information, access or leverage over a target. The term is currently making headlines following the resignation of former Nvidia CEO Jensen Huang following a report on his admitted affair with an alleged Chinese spy.

Honeypots, also known as “honey traps,” are a very humane form of social engineering attack, a category that also includes various forms of phishing and the use of deepfake technologies. And you don’t have to be a billionaire tech CEO to have information that scammers might like.

As competition in the global race for artificial intelligence heats up, OpenAI is reportedly training its employees to recognize espionage tactics, including bribery, romantic manipulation and blackmail, according to the Wall Street Journal. On November 3, cryptocurrency exchange Binance revealed that a recent cyberattack – which resulted in the theft of approximately $6 billion in digital assets – was partially enabled by a fake job interview program that infected an employee’s work computer with malware.

“People can be solicited, bribed, romanced, etc. says Kevin Tian, ​​co-founder and CEO of Doppel, an AI-powered platform intended to help identify and deflect social engineering attacks. He adds: “If you have access to sensitive IP (intellectual property) – it’s not just AI companies – you may be a target. »

Increasingly, fraudsters can use AI to scour websites from Reddit to Pinterest for an individual’s personal information and tailor a scheme designed specifically for them, Tian says. Once they have relevant data points, attackers tend to use “the oldest tricks in the book: inducement, flattery, ego,” says Delaney, a former intelligence officer with the Defense Intelligence Agency and founder and CEO of the Washington, D.C.-based enterprise security consulting firm Vaillance Group.

In many cases, Delaney notes, targets have a feeling that something is suspicious, but they prefer to allow themselves to believe that the interest is legitimate. So how can you avoid becoming a victim? Trust your self-awareness, common sense, and your ability to identify situations that seem too good to be true, she says.

“At the end of the day, we are all human,” Delaney says, adding, “It feels so good to be wanted, respected, appreciated or loved.”

Delaney, who has worked with Fortune 500 companies such as Uber and Merck, advises corporate clients on cybersecurity risks and develops training programs to educate employees about security threats. Her sessions aim to raise awareness of manipulative relationships, such as romance scams, from their inception through their natural progression. “Introductions, then repeated contacts, favors, sensitive requests, secrecy, pressure,” she says.

Bad actors can exploit any information you post online to find an interest that can be mirrored and exploited, or an acquaintance that can be infiltrated and made an introduction. If someone you know and trust introduces you, you may be less likely to “do due diligence” on the new person, even if they’re a stranger, Delaney says.

One of Vaillance’s services is to create a “targeting package” around an executive or member of the C-Suite, Delaney says. “We can show how vulnerable they are and how we would target that organization just by leveraging the people around them in that circle: spouses, friends, children, parents, administrative assistants, neighbors,” she says. “That’s when people’s eyes open.”

From there, she discusses what red flags to look out for. Conversations that start with flattery and seemingly harmless chatter can gradually turn into information seeking, introductions to colleagues, or access to documents, Delaney says. It’s human nature to want to be helpful and respond to friendly requests, she adds. Add in a potential romantic relationship, especially amid an ongoing “loneliness epidemic,” and it can be even harder to resist the urge to conform, she says.

If you feel stuck in a situation where a recent acquaintance or romantic partner keeps asking you for information you’re not comfortable revealing, Delaney says it helps to have practiced polite refusal first. “One of my favorites is: They might just respond with, ‘Why are you asking?'” she says. “Make the other person defensive. You might give any answer. You might say you don’t know. You might say you can’t answer.”

If you’re ever in doubt about a new connection — even if you don’t want to be — do yourself a favor and do a basic check, she recommends. For example, you can review their social media profiles and other publicly available information to see if their story is true.

If you can’t find enough information to allay your suspicions, don’t hesitate to alert your employer’s security or human resources team, she says. For small business or non-workplace scams, you can file a cyberthreat or romance scam complaint with the Federal Bureau of Investigation’s Internet Crime Complaint Center.

And watch out if your new lover starts asking you specific questions about your finances or job qualifications, says Delaney.

“If you don’t have a game at home and you get off a plane somewhere and all of a sudden everyone is mad at you, we call that a red flag,” she says.