\n the Security Issues Report<\/a><\/p>\n
What is social engineering?<\/h2>\n
A social engineering attack<\/i> is when a web user is tricked into doing something
\n dangerous online.<\/p>\n
There are different types of social engineering attacks:<\/p>\n
- \n
- Phishing<\/a>:<\/b>
\n The site tricks users into revealing their personal information (for example, passwords,
\n phone numbers, or social security numbers). In this case, the content pretends to act, or looks and
\n feels, like a trusted entity \u2014 for example, a browser, operating system, bank, or government.<\/li>\n- Deceptive content:<\/b> The content tries to trick you into doing
\n something you’d only do for a trusted entity \u2014 for example, sharing a password, calling tech
\n support, downloading software, or the content contains an ad that falsely claims that device
\n software is out-of-date, prompting users into installing unwanted software.<\/li>\n- Insufficiently labeled third-party services:<\/b> A third-party service<\/i>
\n is someone that operates a site or service on behalf of another entity. If you (third party)
\n operate a site on behalf of another (first) party without making the relationship clear,
\n that might be flagged as social engineering. For example, if you (first party) run a charity
\n website that uses a donation management website (third party) to handle collections for your
\n site, the donation site must clearly identify that it is a third-party platform acting on
\n behalf of that charity site, or else it could be considered social engineering.<\/li>\n<\/ul>\nGoogle Safe
\n Browsing<\/a> protects web users by warning users before they visit pages that consistently
\n engage in social engineering.<\/p>\nWeb pages are considered social engineering when they either:<\/p>\n
- \n
- Pretend to act, or look and feel, like a trusted entity, like your own device or browser,
\n or the website itself, or<\/li>\n - Try to trick you into doing something you’d only do for a trusted entity, like sharing a
\n password, or calling a tech support number, or downloading software.<\/li>\n<\/ul>\nSocial engineering in embedded content<\/h3>\n
Social engineering can also show up in content that is embedded in otherwise benign websites,
\n usually in ads. Embedded social engineering content is a policy violation for the host page.<\/p>\nSometimes embedded social engineering content will be visible to users on the host page, as
\n shown in the examples<\/a>. In other cases, the host site does not contain
\n any visible ads, but leads users to social engineering pages via pop-ups, pop-unders, or other
\n types of redirection. In both cases, this type of embedded social engineering content will
\n result in a policy violation for the host page.<\/p>\nBut I don’t engage in social engineering!<\/h2>\n
Deceptive social engineering content may be included via resources embedded in the page, such
\n as images, other third-party components, or ads. Such deceptive content may trick site visitors
\n into downloading unwanted
\n software<\/a>.<\/p>\nAdditionally, hackers<\/b> can take control of innocent sites and use them to
\n host or distribute social engineering content. The hacker could change the content of the site
\n or add additional pages to the site, often with the intent of tricking visitors into parting
\n with personal information such as credit card numbers. You can find out if your site has been
\n identified as a site that hosts or distributes social engineering content by checking the
\n Security Issues report in Search Console.<\/p>\n
- Deceptive content:<\/b> The content tries to trick you into doing
![\"Social](\"https:\/\/lh3.googleusercontent.com\/M1marY2U0TpG5jlbdOE-ISvmUaoLErD03-95JxDdxD89VDuUmgmctDiOOMmKOzZxB2Q=w280\" "\\"Deceptive")
![\"Example](\"https:\/\/lh3.googleusercontent.com\/Opsb7huiddG8az9vN9rF6Ds0I_QLsJpd_VVQfjElnB9hZNQxnDwO21YJBloBq8YAs4OB=w673\")
![\"Fake](\"https:\/\/lh3.googleusercontent.com\/uTWvxf7NR7alzT_VEF1wD31v3l6CeKG7M7nN4wpa-Z_nSGb5xsMUi19RTUTKQimqbu0=w577\")