In early 2024, a finance employee at the Hong Kong office of the engineering firm Arup received a message that appeared to come from the company's UK-based chief financial officer, about a confidential transaction. He was suspicious until he joined a video call and saw the CFO and several colleagues he recognized. He then made 15 transfers totaling about HK$200 million, roughly US$25 million. Every other person on that call was a deepfake.
Attacks like this target people rather than software. On the CompTIA Security+ SY0-801 exam, objective 2.3 lists human-based threat vectors (impersonation, contractors, visitors, biometrics and watering holes) among the paths attackers use to reach a target, and objective 2.5 names impersonation and deepfakes as social engineering attacks you'll need to recognize from a scenario. This lesson covers each one, the indicators it leaves, and the checks that still work when the person in front of you, or on screen, isn't who they appear to be.
Human-based vectors use people's trust, access and habits as the way in
A threat vector is the path an attacker uses to reach a target. Human-based vectors run through people instead of through a software flaw: someone's willingness to help a person who seems legitimate, the access a contractor or visitor is given, a body part used for authentication, or the websites a group visits every day.
The objectives list these vectors by name without defining them. This lesson uses their common meanings:
- Impersonation: posing as a specific person or a trusted role.
- Contractor: using, or posing as, third-party staff who hold legitimate access.
- Visitor: abusing the access a guest is given inside a facility.
- Biometric: defeating or abusing fingerprint, face or voice authentication.
- Watering hole: compromising a website the target group already trusts and visits.
Deepfakes cut across several of these. They are the newest tool for impersonation, and they are increasingly aimed at biometric checks as well.
Impersonation borrows someone else's authority or reason to be there
Impersonation means pretending to be someone the victim has a reason to trust or obey. It can be a specific person, such as the CEO, a named employee or a known vendor contact, or a role: a help desk technician, a fire inspector, an auditor, a copier repair technician, a new hire on day one. The cover story that explains why they need something is called a pretext, and practiced impersonators bring props that fit it: a high-visibility vest, a clipboard, a lanyard, a ladder.
Impersonation works in every channel. In person, it gets an attacker past reception or into a wiring closet. On the phone, it's the core of vishing. In email, it's the display name and lookalike domain of a phishing message.
The indicators are about fit and verification. The visit or call wasn't announced. The request falls outside the normal process, or the person asks for more than the role needs: a fire inspector who wants to be alone in the server room, an auditor who wants a copy of the password vault. The person drops executives' names, pushes for speed, or gets irritated by questions. And nothing they say can be confirmed independently.
The control is verification through a channel the impersonator doesn't control. Reception calls the facilities manager at the directory number to confirm the work order. An employee calls the vendor's known support line. Visitors with genuine business wait while this happens and are escorted afterward. Staff need explicit permission to challenge anyone, including someone who claims to be senior, without fear of being blamed for the delay.