A note before the stories: I don’t name companies or locations in these articles, and I generalize identifying details. Specifics are a gift to attackers, even decades later, and the discretion is part of the trade. It’s also, not coincidentally, what my ghostwriting clients rely on when they hand me their own war stories.
Social engineering has a physical branch, and at a major national retailer we met it repeatedly.
The classic was the printer guy. A man walks into a location in work clothes, says he’s here to service the laser printers, replace the cartridges, the big bulky units everyone had back then. The person on site doesn’t know any better, and why would they? Printer service visits are real things that really happen.
I have a particular contempt for this kind of attacker, because of who he uses.
He walks past every piece of technology the company paid for and goes straight to the person at the front counter, somebody hired to be helpful, and turns that helpfulness into his way in. When it works, the clerk who opened the door carries the guilt, and I think that’s backwards. The blame belongs to whoever sent that clerk to work without a rule to follow.
Except the printer guy doesn’t want the printers. He wants the building. Once inside, he can look at what is on desks, what’s on screens, what’s plugged into what, and sometimes he can swap equipment while he’s at it. The printer is the pretext; the access is the payload.
How did the fake printer technician try to swap a POS terminal?
The serious version of this attack came for the payment terminals. A man showed up at one of our locations to service the point-of-sale terminals, carrying replacements. Hacked replacements: the same model we ran, modified to intercept cards and capture the card verification data, the security code that makes stolen numbers usable.
Think about what that terminal would have done.
The printer is the pretext; the access is the payload.
Every customer who paid with a card at that register would have handed a stranger a usable card number and security code, and none of them would have known until the fraudulent charges showed up. Those people trusted the store with their money. A skimmer turns that trust into somebody else’s spending money, and the store’s name ends up in the news story.
What stopped him was a policy we’d just rolled out, and its power was its simplicity.
We didn’t train staff to evaluate technicians or inspect equipment; frontline staff can’t be equipment inspectors and shouldn’t have to be. The policy was: anyone shows up wanting to touch equipment, you call IT. Here’s the number. That’s the whole policy.
The staff called. Something in the exchange spooked the man, because he dropped his gear and ran.
We did forensics on what he left behind and confirmed it: a compromised terminal, our exact model, ready to skim every card in the store. We never caught him. We never had to; the attack died at a phone call.
The phone version of the printer guy
The same pretext works by telephone. Callers claiming to be printer vendors would ring locations and ask who was in charge of what: who runs IT, who approves purchases, who’s the manager’s manager. That’s reconnaissance for spear phishing. Map the hierarchy, then craft emails impersonating the right names to the right targets. Those attempts failed with us for the same unglamorous reason: staff had strict instructions not to give out organizational information, full stop.
The person at the front desk who refuses to recite the org chart to a stranger on the phone is doing security work, and I think they deserve to hear that from their bosses. A company that treats that caution as bad customer service, and apologizes to the irritated caller, teaches every employee that being pleasant to strangers outranks protecting coworkers, and attackers count on companies teaching exactly that.
The attack that swaps your payment terminals arrives dressed as a service call. The defense is a phone number and permission to use it.Share on X
Why does in-person social engineering endure?
Decades of firewalls haven’t retired the man in the work shirt, and the economics explain why. A physical pretext attack costs a uniform, a clipboard, and nerve. It defeats, in one stroke, every network control the target owns, because it doesn’t touch the network; it touches the loading dock. And its failure mode is gentle: a technical intrusion leaves logs, while a challenged impostor leaves a building, as ours did, and is simply gone. Low cost, high yield, graceful abort.
Attackers are rational, and against a well-defended network the rational move is frequently the front door. I think it’s negligent for a company to pour its security budget into the network and leave the front door to whoever happens to be working that shift, with no rule and no phone number.
The pretexts evolve with office equipment, printers then, network gear and access points now, but the play is constant: arrive as someone whose presence requires no explanation, and let normalcy do what an exploit would otherwise have to. The defense is equally constant, and that’s the encouraging half of this story.
Verification procedures don’t rust the way software does. The call-IT policy that stopped our terminal swap would stop the same attack today, unmodified.
My take
Hand every location one phone number and permission to use it. Anyone who shows up to touch equipment, staff call IT first. That rule made an attacker carrying a hacked payment terminal drop his gear and run. Tell staff never to recite the org chart to a caller, and back them when a stranger gets irritated. Front-desk caution is security work. A procedure like that doesn’t rust, and it would stop the same attack today.
How do you design against social engineering?
Both defenses share a shape worth stealing. They don’t ask frontline people to detect deception, a losing game against a professional. They give frontline people a single cheap action that routes the decision to someone equipped to make it. Call this number. Don’t answer that question. The attacker’s craft is defeating judgment; the defense removes judgment from the encounter.
Executives who write about security keep gravitating toward the digital and skipping the man in the work shirt, and I think they’re shortchanging their own readers.
Those readers run warehouses, stores, and offices where he’s the live threat today. If you stopped an impostor at your door, that story belongs in your book, along with the one-line policy that stopped him. A store manager can hand that chapter to the front counter on Monday morning, and it’ll protect more customers than another chapter on firewalls.
For more from this series, see The Cybersecurity Hub: breaches, audits, and hard-won security lessons from four decades in the trenches.
