Melanie
Welcome to the Monday Morning Marketing podcast for all decision-makers and action-takers. Take it away, Esther.
Esther
And welcome back to another episode of the Monday Morning Marketing podcast. Today, we're talking about social engineering, the good, the bad, and the ugly. And it does get quite ugly, unfortunately. So what is social engineering, first of all? Melanie?
Melanie
It is, as stipulated by Wikipedia, a manipulation technique that exploits human psychology to gain private information, access, or valuables. It encompasses a variety of possible cyberattacks that use psychological tactics to manipulate individuals into revealing sensitive information or performing actions that compromise security. This can also include deceptive tactics that lead to unauthorized access to systems, data theft, or financial fraud. Overall, social engineering relies on tricking individuals rather than exploiting technical vulnerabilities.
Esther
So this topic came to light because of a recent cyber attack here in the United Kingdom on a very prominent super... I suppose it is a supermarket as well, but a very prominent store called Marks & Spencers. Now, Marks & Spencers has been around for hundreds of years at this point. I haven't looked into the exact number, but it's over 100 years anyway that Marks & Spencers has been around. And their attack came to light about a month after it had happened because they had gained access through social engineering. That's mental. And how they had gained access was by simply sending a reset password email. They pretended to be somebody or they gained access. I'm not sure which one it was, but they pretended to be someone who works for Marks & Spencers and sent an email to the IT department asking for the password to be reset for the access to the website. And they got in quietly, and they started making their changes quietly and subtly. And after a month was when Marks & Spencers realized that it had a cyber attack was happening. And at the time of recording, it will still take them another 2-3 months to fix.
And this is very scary for the business, obviously. At this point, it has already lost £300 million of profit, but also for the people who usually buy from Marks & Spencers, because it's talking about access to their data or data, whatever way you pronounce it. It is talking about payment plan, access to payment methods. It's talking about personal information that has been hijacked. It has been compromised, and all because the IT department thought that the email came from someone with authority and someone that had or was supposed to have this access to the website. Now, how they gained access to the employee's email is uncertain, but it's probably through another round of social engineering to manipulate that person, maybe into changing their password into something that they would have I don't know what they're getting access to.
Melanie
They would probably claim they were an internal team contacting somebody, again, internally. I mean, these days, I've seen it with flight companies that they copy the website completely, but they added dot, or they use a zero instead of an O as part of the... It's so subtle that you can't see the difference in the website. You quite Can't really go to order something or update something and you've given them access. It could be something as easy as that.
Esther
Yes. And it is now, as Melanie was saying in the very long description of what social engineering is. There is an element of good to it or ways that companies can benefit from using social engineering. I don't think for customers, social and social engineering is exactly good, but there are six key principles behind it. So there's reciprocity, I can never say that word properly. Reciprocity, commitment and consistency, social proof, authority, liking, and scarcity. So starting with reciprocity, people tend to return a favor, for example, free samples in marketing. Okay, so give me your email address and I'll give you a free download. Simple enough, right? So that's a thing of social engineering. But people aren't likely to give you their email address unless they think you have authority or they like you. If they feel any ick or any conflict in giving their information, they won't do it. No matter what you're trying to give away for free, they'll be Is it too good to be true? You always have to think that. Always think, Is it too good to be true?
Melanie
And on the social proof things, we as a human As human beings, we want to see a validation from others when we make decisions. That's where we use TripAdvisor, where we use Google Business Profile. Reviews in general helps people understand that you are delivering what you are offering. And social proof can be a way of seeing how the customer is reviewing and providing testimonials and user-generated content like we mentioned earlier on. So it's just a way to influence potential buyers with decent, honest social proof. It imbues trust.
Esther
Yes. Now, where people these days are a little more skeptical is when it comes to using influence. Influencers with that social proof, because a lot of the times the influencers are being paid to say that the product is really good. So I think nowadays people are going, Is it really good, though, or are they just saying it's good?
Melanie
That's why I mentioned user-generated content rather than influencer, because the user-generated content would tend to be taken more sincerely.
Esther
Definitely, definitely. But when it comes to then the scarcity aspect, it's the last 20 tickets available, flash sale, just you only have one hour left to buy. All of those things that create the FOMO or the fear of missing out. Work to a certain extent, as long as you, as the company, stick to it and don't say, actually, that was just our Timer kept on going or or it resets every time you go into the website, it will still say one hour to go. So I think you have to be very careful when doing that because you can lose your credibility and lose the trust factor. If you say, the last 20 tickets at this price and then offer five more at the same or lower price. I think that's where people start going, and they'll revert back to their last minute, last minute purchases like they always do. So having that scarcity and urgency works if you, as a company, abide by it and have without What's the word? Without losing that trust by resetting the Timer or going, actually, we'll just add in another 20 tickets at that same price. Then you lose people's trust.
Melanie
Don't forget, storytelling also plays a huge role in you connecting with people. We're ready to listen to stories and narratives in general. And as a business owner and running your company, it doesn't matter whether you're product or service, it genuinely doesn't. As long as you use a technique that evokes an emotion, hopefully a positive one, and use that as part of your building your brand identity, I do think that's going to be a really strong way for you to connect with people as well, especially when it comes to the social engineering part. It helps you really leverage your relationship on a more personal level. It makes you much more memorable and something that people would be more happy to share in conversations around the water-cooler or a mother and toddler group or wherever your audience is by telling a story.
Esther
Yeah, and it helps people to relate to you as the brand and think, these people get me or this company understands me because they went through the same situation that I did or they went through the same problems. Or if you're starting out in business and you've got all the first five year dread of, well, my company actually succeed, thing. And somebody comes alongside you and says, I had the same and I went through these problems. So to avoid these issues, I can help you. That gives you the reassurance that, well, they survived. So if I do this as well, then hopefully I'll survive. And people want to feel that connection, and they want a community around them, even if it's with people that they don't know or if it's a big multinational corporation. You know, Going back to the Marks & Spencers hack, my mom, who's 82, is really annoyed that she cannot buy online at the minute because they've had to bring down their online purchasing portal. And I keep telling her, you don't want to be able to buy online right now from them because it's not safe. And she just doesn't get that part. She just wants to. She loves Marks & Spencers.
Melanie
That's convenient, isn't it?
Esther
It is, but she's a huge advocate of Marks & Spencers. I mean, most of her clothes comes from there and all the food in the house will come from the supermarket. She has always loved them. And when her niece worked for them for 25 years, that was just an added bonus of a family that work for them.
Melanie
It must be some nice perks as well.
Esther
Well, niece did, yeah. But it gave her that extra sense of connectivity to the brand, which you don't get these days with a lot of brands. A lot of brands, a lot of brands are very faceless and very cold. So if you can bring in the storytelling element, and you don't have to lay down your deepest, darkest secrets. You don't have to reveal all the bad stuff that has happened in your life. But if you can reveal something, then people will relate to you.
Melanie
Have you got any others? I've got one more thing I could mention.
Esther
Oh, mention it away.
Melanie
Gamification. I love gamification. So what do I mean by that? Well, it's where you're making the shopping experience, whether it's online or in person, more interactive and more engaging. And one of the ways you can do that is like a loyalty program or maybe an affiliate account or something like that, a reward system, basically, that incentivises your longer term customers to interact with your brand, which thus increases engagement and then fosters repeat purchases. So is there a way you can create some gamification? Because that's definitely a really good way to use social engineering positively for business.
Esther
Yeah, and I'm going to be bad cop again in this one. I recently heard, well, the UK government is going after Timo. And I think maybe Sheen as well, but definitely against Timo, because of the gamification element when you open their app and all the things pop up and say, you have one and you get five things for a pound if you just spend 40 pounds. So the government is saying that it is like false advertising or false... It's forcing people into spending money to get these five items at a pound or whatever it is. I don't remember exactly the amount. But when you go on and it's very bright and colorful and it's all spinning objects and it's spin the wheel and see what you win and everybody wins. And even my kids have been subjected to it. Now my kids are 14, no sorry, 15 and 13, just had a birthday. And my 13-year-old is very susceptible of things online. And he will see an ad and just go, oh, I want to click that. Just don't click it. Just don't click it. It's like, oh, I won. Yes, everybody wins. It's not the same if there's no challenge behind it. I have-.
Melanie
You don't have to How do you like that, though? I mean, if you're creating your own gamification, you can do it more ethically. I mean, this is why today was about the good, the bad, and the ugly.
Esther
Yes.
Melanie
Okay, so I'm trying to show the good.
Esther
Well, I do have a good one as well. Go on. I do. So we were recently at AtomaCon, which is a wonderful conference in the United Kingdom, and they have a gamification app every year. Now, you don't win anything, bar bragging rights of being the top of the table. Do I try every year? Yes, I do. Yes, I do. And how do you get to be the top of the table? You like the sessions that you've gone to, you message people, you connect with people through the app.
Melanie
The more connections you get, definitely. And also just actually responding to posts was another way of getting more points. And the more points you get, as you say, you don't of the prizes. This isn't the Brucey bonus here. For those of you that don't know what we're talking about, they were talking about Bruce Forsyth, who did the Brucey bonus. What do points make? Prizes.
Esther
We're showing our age now, again.
Melanie
We really are.
Esther
But you don't... Sometimes it is just that the thrill of the game. It's like you're a gamer, Melanie.
Melanie
I am.
Esther
You don't always have to reach the end of the level to feel that satisfaction of having accomplished something or to feel that reward that you get.
Melanie
But you do get some rewards, you just don't get the last reward.
Esther
Yeah, exactly.
Melanie
You get a certain dopamine hit, which is what we're trying to do. Every single thing that we're trying to do online, specifically online, is to create a dopamine hit that people want to repeat.
Esther
Yes. But when social engineering techniques like these are applied ethically, they can serve as valuable marketing tools for retailers. And don't even have to be just retailers. Service providers can also get in on these things, especially with the loyalty program, affiliate programs, things like that, storytelling, obviously. But by understanding consumer psychology and leveraging these tactics, like I said, social proof, scarcity, storytelling gamification, you can influence customer behavior, drive sales, and most importantly, foster brand loyalty. Because brands, big brands, don't seem to need or want that loyalty anymore. I get the feeling anyway.
Melanie
I think in some extent, there becomes a complacency that just happens. And that's why every now and then, these particular brands have to do something shocking. They bring in a new footballer, they bring in a new location, they get sponsored by some completely random business to shake things up. If they can do it, so can you. We're hoping that by listening to today's episode, it inspires you to try something different.
Esther
Yes, that does not include hacking.
Melanie
That does not include hacking. Please do not hack. Okay, well, that's all the time we have for for now. Thank you so much for listening. We'll be back again next week with another podcast. Have a great week. Bye for now.
Esther
Bye-bye.
Always with the wave.
Melanie
Well, now we're always doing video. I feel justified in doing it.
Esther
We shall see.
