Security Update: November 2025 – Social Engineering Scams Rise
Social engineering scams are on the rise in the UK, with attackers using increasingly sophisticated tactics to trick individuals and businesses. In November 2025, Action Fraud and the NCSC reported a 30% increase in reported incidents, with financial losses and data breaches affecting organisations of all sizes. (And yes, the scammers are getting cleverer. Your nan’s Facebook is not safe.)
What Happened?
- Phishing: Fake emails and websites designed to steal login credentials and payment info. If it looks too good to be true, it probably is.
- Vishing: Phone calls from scammers posing as banks, HMRC, or IT support. If someone calls about “urgent tax refunds,” hang up and make a cuppa.
- Impersonation: Attackers pretending to be trusted colleagues or suppliers to request payments or sensitive data. If your boss suddenly wants gift cards, be suspicious.
- Case Study: BBC: Social Engineering Scam Case
How to Protect Yourself & Your Business
- Be Skeptical: Treat unsolicited requests for sensitive information with caution. Paranoia is underrated.
- Verify Identities: Always confirm identities via a separate channel before sharing data or making payments. If in doubt, ask twice.
- Staff Training: Regularly train employees on the latest scam tactics and how to respond. Bonus points for not clicking on “You’ve won a free cruise!”
- Multi-Factor Authentication: Add extra layers of security to accounts and systems. Because passwords like “password123” are not clever.
- Incident Response: Have a clear plan for reporting and responding to suspected scams. And maybe keep a stress ball handy.
Resources & Reporting
- Action Fraud: Social Engineering
- NCSC: Social Engineering Guidance
- SANS Security Awareness: Social Engineering
- FTC Scam Alerts
Actionable Checklist
- [ ] Review and update staff training
- [ ] Enable multi-factor authentication
- [ ] Test your incident response plan (before disaster strikes)
- [ ] Share scam alerts with your team (and your nan)
Frequently Asked Questions
Q: What is social engineering?
A: It’s a tactic where attackers manipulate people into giving up confidential information. Like a dodgy magician, but with less glitter.
Q: How can I spot a scam?
A: Look for urgent requests, suspicious links, and verify identities before sharing information. If it smells fishy, don’t bite.
Q: What should I do if I fall victim to a scam?
A: Report it to Action Fraud, inform your bank, and update your security settings immediately. And maybe change your passwords to something less obvious.
Q: Are small businesses at risk?
A: Yes. Attackers often target small businesses due to less robust security and training. If you think you’re too small to be hacked, think again.
Q: How can I keep up with the latest scams?
A: Subscribe to alerts from Action Fraud, NCSC, and the FTC. Or just ask your local IT nerd.
Need help with cybersecurity? Contact us for a tailored security audit, staff training, and ongoing protection for your business. We promise not to judge your password choices (much).
This post was brought to you by caffeine, sarcasm, and a mild distrust of marketing buzzwords. If you enjoyed it, share it before your competitors do.