Catfishing Definition

What is Catfishing?

Catfishing is a deceptive social engineering tactic in which the attacker creates a fake, enticing social media profile. These profiles are then used to build relationships with the target to achieve various malicious goals, such as financial theft or extracting sensitive information.

How Does Catfishing Work?

Catfishing began with romance scams. Attackers would create profiles on dating sites and social media including fake photographs, life stories, and other details. They then attempted to connect with other users for various purposes, not all of which are malicious. The catfisher may lie to overcome self-esteem issues, or their goal might be to steal money from their targets.

Today, the definition of catfishing has evolved to focus on catfishing with malicious intent and has expanded to include the use of fake social media profiles other than dating profiles. Some of the most common goals of catfishing attacks include:

• Financial Fraud: Financial fraud was an early goal of catfishing attacks because the attackers would try to coerce their targets into sending them money. Modern catfishing attacks can target individuals or businesses into sending money in different ways, such as a payment to close an alleged deal.
• Data Theft: Catfishing attacks are often designed to extract sensitive personal or business information. For example, a catfisher may try to get their target to talk about a secret project at their job or to provide sensitive information such as their social security number (SSN) that the attacker could use for identity theft.

Detecting Catfishing Profiles

Often, catfishing profiles will have some warning signs. Some methods for detecting the fake profiles used in these attacks include:

• Image Searches: Catfishers will often use profile pictures that they found online. Google’s Reverse Image Search can be used to see where else an image is used on the Internet, making it possible to check if that image is also associated with someone else.
• Inconsistent Profiles: A catfisher needs to build a fake background story to carry out their attack, and they can make mistakes or not put in the work. A profile with inconsistent details or missing ones could be a sign of a catfishing attack.
• Limited Activity: Catfishers’ profiles are designed to build rapport with someone and make a malicious request. A profile with few connections or online activity might be a sign of a catfisher.
• Repeated Openers: Often, catfishers will use the same, canned opening line when starting up a conversation. Multiple connection requests with the same opener are likely a red flag.
• Rapid Relationship Building: Catfishers attempt to build a relationship with their target to achieve some goal. A profile that quickly tries to build rapport and then asks for something is likely a catfisher.

Protecting Against Catfishing Attacks

Catfishing attacks can be damaging both personally and professionally. Some methods for limiting the potential damage include:

• Accept Requests Carefully: Before accepting a connection request, look into the profile and attempt to verify the legitimacy of the profile and the owner’s identity.
• Don’t Send Money: Catfishing is often designed to steal money from the victim. Never send money to someone that you’ve only met online.
• Don’t Share Secrets: Stealing data — both personal and professional — is another common catfishing goal. Never share sensitive personal or professional information on social media.

Conclusion

Catfishing is a social engineering tactic that uses deception to build a relationship with a target. After doing so, the attacker requests money or sensitive information from their target. Watch out for warning signs of catfishing profiles and never send money or secrets to someone that you’ve only met online or to a profile that you haven’t verified.