Shawnee Delaney often kicks off a training session by telling a room full of corporate workers: “OK, raise your hand if you’ve ever gotten a flattering message on LinkedIn just complimenting your background and your profile and your experience.”
“Every hand goes up,” she says. Then, she tells attendees how responding to a simple adulatory message could unwittingly open the door to a potential romance scam.
Delaney is a corporate security expert, well-versed in teaching people how to avoid “honeypot” schemes, in which a bad actor uses romantic or sexual interest to build trust and gain information, access or leverage over a target. The term is currently making headlines in the wake of former Nvidia CEO Jensen Huang’s resignation from the company, following reporting on his admitted affair with an alleged Chinese spy.
Honeypots, also known as “honey traps,” are a very human form of social engineering attack, a category that also includes various forms of phishing and use of deepfake technology. And you don’t have to be a billionaire tech CEO to possess information that scammers may value.
As competition in the global artificial intelligence race heats up, OpenAI is reportedly training employees to recognize espionage tactics including bribery, romantic manipulation and blackmail, according to The Wall Street Journal. On Nov. 3, cryptocurrency exchange Binance revealed that a recent cyberattack — which saw roughly $6 billion of digital assets stolen — was partially made possible by a fake job interview scheme that infected an employee’s work computer with malware.
“People can get solicited, bribed, romanced, etc.,” says Kevin Tian, co-founder and CEO of Doppel, an AI-powered platform meant to help identify and deflect social engineering attacks. He adds: “If you’ve got access to sensitive IP [intellectual property] — it’s not just AI companies — you can be a target.”
Increasingly, scammers can use AI to scour websites ranging from Reddit to Pinterest for an individual’s personal information and customize a ploy designed specifically for them, Tian says. Once they have relevant data points, attackers tend to use “the oldest tricks in the book: elicitation, flattery, ego,” says Delaney, a former intelligence officer with the Defense Intelligence Agency and the founder and CEO of Washington, D.C.-based corporate security consulting firm Vaillance Group.
In many cases, Delaney notes, targets have an inkling that something is suspicious — but they’d rather allow themselves to believe the interest is legitimate. So how do you keep yourself from falling victim? Trust your self-awareness, common sense and ability to identify situations that feel too good to be true, she says.
“The bottom line is, we’re all human,” says Delaney, adding: “It feels so good to be wanted, or to be respected, or to be appreciated, or loved.”
How to spot red flags and do some vetting
Delaney, who has worked with Fortune 500 companies such as Uber and Merck, advises corporate clients on cybersecurity risks and develops training programs to improve employees’ awareness of security threats. Her sessions aim to build awareness of manipulative connections, such as romance scams, from how they begin to the natural progression they often take. “Introduction, then repeated contact, favors, sensitive requests — the secrecy, the pressure,” she says.
Bad actors may tap into any information you post online to find an interest that can be mirrored and exploited, or an acquaintance who can be infiltrated and make an introduction. If someone you know and trust makes an introduction, you might be less likely to “go do due diligence” on the new person, even if they’re a stranger, Delaney says.
One of Vaillance’s services includes building a “targeting package” around an executive or C-Suite member, says Delaney. “We can show how they are vulnerable and how we would target that organization just by leveraging the people around them in that circle: spouses, friends, kids, parents, administrative assistants, neighbors,” she says. “That’s when people’s eyes open.”
From there, she discusses red flags to spot. Conversations that begin with flattery and seemingly innocuous small talk can gradually shift toward digging for information, introductions to colleagues or access to documents, says Delaney. It’s human nature to want to be helpful and fulfill friendly requests, she adds. Add a potential romantic connection to the mix, especially amid an ongoing “loneliness epidemic,” and the urge to comply can be even harder to resist, she says.
Shawnee Delaney’s Vaillance Group creates security plans and offers training programs for large organizations.
Source: Shawnee Delaney
If you feel yourself getting cornered in a situation where a recent acquaintance or romantic partner keeps asking for information you’re not comfortable revealing, Delaney says it helps to have first practiced polite refusal.”One of my favorites is: They could just respond with: ‘Why do you ask?'” she says. “Put the other person on the defensive. You could give a nondescript answer. You can say you don’t know. You can say you can’t respond.”
If you’re ever suspicious of a new connection — even if you don’t want to be — do yourself a favor and conduct some basic vetting, she recommends. You might examine their social media profiles and other publicly available information, for example, to see if their story checks out.
If you can’t find enough information to allay your suspicions, don’t be shy about alerting your employer’s security or human resources team, she says. For smaller companies, or scams outside the workplace, you can file a complaint for cyber threats or romance scams with the Federal Bureau of Investigation’s Internet Crime Complaint Center.
And pay attention if your new paramour starts asking you specific questions about your finances or work credentials, says Delaney.
“If you have no game at home, and you get off an airplane somewhere and suddenly everyone’s all over you, we call that a red flag,” she says.
About The Author
