Social engineering, in the context of Certified Fraud Examiner (CFE) practice and cyberfraud, refers to the manipulation of human psychology rather than technical vulnerabilities to gain unauthorized access to information, systems, or funds. Fraudsters exploit trust, authority, urgency, fear, curiosity, and the natural desire to be helpful. Common techniques include phishing (deceptive emails), spear phishing (targeted emails using personal details), vishing (voice calls), smishing (SMS messages), pretexting (fabricating a believable scenario), baiting (offering something enticing), and tailgating (physically following someone into a secure area). CFEs study social engineering because it bypasses even strong technical controls; the weakest link is often the employee who clicks a link, shares a password, or approves a payment under pressure.

Business Email Compromise (BEC) is one of the most financially damaging forms of social engineering. In a BEC scheme, criminals either spoof or compromise a legitimate business email account, typically belonging to an executive, vendor, or attorney, and use it to instruct employees to transfer funds, change vendor banking details, or release sensitive data such as W-2 forms. Variants include CEO fraud (impersonating senior leadership to request urgent wire transfers), vendor or invoice fraud (altering payment instructions on legitimate invoices), account compromise (using a hacked internal mailbox to request payments), attorney impersonation, and payroll diversion. According to the FBI's Internet Crime Complaint Center, BEC consistently produces billions of dollars in annual losses, far exceeding ransomware.

From a CFE perspective, prevention and detection hinge on both controls and awareness. Key measures include dual authorization for wire transfers, out-of-band verification (calling a known number) before changing payment details, multi-factor authentication on email, domain-based protections such as DMARC, SPF, and DKIM, monitoring for look-alike domains, and continuous employee training with simulated phishing. When investigating BEC, CFEs examine email headers, login logs, mailbox forwarding rules, and fund flows, coordinate quickly with banks to attempt recalls, and preserve evidence for law enforcement. Understanding the human element is essential to combating these schemes.

In the Certified Fraud Examiner (CFE) body of knowledge, cyberfraud frequently relies on malware—malicious software designed to damage, disrupt, or gain unauthorized access to systems and data. Fraud examiners must understand both the types of malware and the vehicles (delivery methods) used to spread it.

Common malware types include:

1. Viruses – self-replicating code that attaches to legitimate programs or files and spreads when those files are executed.
2. Worms – standalone programs that replicate across networks without user action, often consuming bandwidth or delivering payloads.
3. Trojan horses – software disguised as legitimate applications that secretly perform malicious functions, such as creating backdoors.
4. Ransomware – encrypts a victim's data and demands payment for the decryption key; a major driver of modern cyber extortion.
5. Spyware – covertly collects information such as browsing habits, credentials, or financial data.
6. Keyloggers – record keystrokes to capture passwords, account numbers, and other sensitive input.
7. Rootkits – conceal the presence of malware by modifying operating system functions, making detection difficult.
8. Adware – displays unwanted advertisements and may track user behavior.
9. Botnets – networks of compromised computers (zombies) controlled remotely to launch spam campaigns, distributed denial-of-service attacks, or click fraud.
10. Logic bombs – dormant code triggered by specific conditions, such as a date or an employee's termination.

Malware vehicles, or delivery mechanisms, include:

- Phishing and spear-phishing emails containing malicious attachments or links.
- Drive-by downloads from compromised or malicious websites that exploit browser vulnerabilities.
- Infected removable media such as USB drives (e.g., 'baiting' attacks).
- Software downloads, pirated programs, and fake updates.
- Malvertising—malicious code embedded in online advertisements.
- Social engineering via social media, instant messaging, or SMS (smishing).
- Exploitation of unpatched vulnerabilities and remote desktop services.
- Supply chain attacks that compromise trusted vendors or software.

For CFEs, recognizing these types and vehicles supports fraud risk assessments, incident investigations, evidence preservation, and the design of controls such as patching, endpoint protection, email filtering, and employee awareness training.

Preventing cyberfraud, within the Certified Fraud Examiner (CFE) body of knowledge, refers to the proactive measures organizations and individuals implement to reduce the likelihood of fraud committed through computers, networks, and digital systems. Because cyberfraud exploits both technological weaknesses and human behavior, effective prevention blends technical controls, governance, and awareness.

First, organizations should adopt a risk-based approach. A cyberfraud risk assessment identifies valuable assets, likely attack vectors (phishing, business email compromise, ransomware, identity theft, account takeover, and payment fraud), and existing control gaps. Findings guide where resources are best spent.

Second, strong technical safeguards form the foundation. These include multi-factor authentication, least-privilege access controls, timely patch management, encryption of sensitive data, network segmentation, firewalls, intrusion detection systems, endpoint protection, and secure configuration of systems. Regular backups stored offline mitigate ransomware damage, and logging with continuous monitoring enables early detection of anomalies.

Third, policies and procedures reduce opportunities for fraud. Segregation of duties, dual authorization for wire transfers, call-back verification for changes to vendor bank details, and documented incident response plans are essential. Vendor and third-party risk management ensures partners meet security standards.

Fourth, the human element is critical. Employees are the most common entry point for attackers, so ongoing security awareness training, simulated phishing exercises, and clear reporting channels for suspicious activity are vital. A culture that encourages questioning unusual requests, even from executives, helps thwart social engineering.

Fifth, governance and compliance tie efforts together. Management commitment, defined ownership of cybersecurity, adherence to frameworks such as NIST or ISO 27001, cyber insurance, and periodic audits and penetration tests strengthen resilience.

Finally, CFEs contribute by assessing fraud risks, designing anti-fraud controls, investigating incidents, and recommending improvements. Prevention is never absolute, but layered defenses—technology, process, people, and oversight—significantly reduce exposure and limit losses when attacks occur.

Detecting cyberfraud, within the Certified Fraud Examiner (CFE) body of knowledge, refers to the processes, tools, and investigative techniques used to identify fraudulent activity committed through computers, networks, or digital systems. Because cyberfraud schemes such as phishing, business email compromise, account takeover, ransomware extortion, and payment diversion often leave few physical traces, detection relies heavily on monitoring digital evidence and recognizing behavioral and transactional anomalies.

A core detection method is log analysis. Organizations should capture and review system, application, network, and access logs to identify unusual login times, repeated failed authentication attempts, access from unexpected geographic locations, privilege escalations, or large data transfers. Security Information and Event Management (SIEM) tools aggregate these logs and apply correlation rules to flag suspicious patterns in near real time.

Data analytics is another key technique. CFEs use tests such as Benford's Law, duplicate payment searches, vendor master file comparisons, and outlier detection to identify fraudulent transactions. Behavioral analytics and machine learning models can establish baselines of normal user or customer activity and alert on deviations, such as a sudden change in bank account details for a vendor or an employee downloading files outside their job role.

Network and endpoint monitoring, including intrusion detection systems, anti-malware tools, and data loss prevention software, help detect unauthorized access or exfiltration. Email filtering and domain monitoring can reveal spoofed addresses used in social engineering attacks.

Detection also depends on people. Tips remain the most common way fraud is uncovered, so hotlines, whistleblower channels, and employee awareness training are essential. Red flags include customers reporting unauthorized transactions, mismatched IP addresses, altered payment instructions, and pressure for urgent secrecy in communications.

Finally, CFEs emphasize preserving digital evidence through forensic imaging and chain-of-custody procedures once suspicious activity is detected, ensuring findings remain admissible and support subsequent investigation and prosecution.