Honeypot Scams: What Experts Say They Train People to Avoid
Corporate security expert Shawnee Delaney teaches workers to spot romance-based 'honeypot' schemes. As the term hits headlines after Jensen Huang's resignation from Nvidia, she and Doppel's Kevin Tian explain who is targeted and the warning signs.
Shawnee Delaney, a corporate security expert and the founder and CEO of Vaillance Group, opens her training sessions by asking workers to raise a hand if they have ever received a flattering LinkedIn message, and she says every hand goes up. It is the first step in how they train people to avoid "honeypot" scams, in which a bad actor uses romantic or sexual interest to gain information, access or leverage over a target.
The term is in the news because former Nvidia CEO Jensen Huang resigned from the company after reporting on his admitted affair with an alleged Chinese spy.
Not just a billionaire's problem
Honeypots, also called honey traps, are a form of social engineering, meaning attacks that manipulate people rather than software. The category also includes phishing and deepfake technology. You do not have to be a tech chief to hold information a scammer wants.
OpenAI is reportedly training employees to recognize espionage tactics, including bribery, romantic manipulation and blackmail. On Nov. 3, cryptocurrency exchange Binance said a recent cyberattack, in which roughly $6 billion of digital assets was stolen, was partly made possible by a fake job interview scheme. The scheme infected an employee's work computer with malware.
"People can get solicited, bribed, romanced, etc.," said Kevin Tian, co-founder and CEO of Doppel, an AI-powered platform that helps identify and deflect social engineering attacks. He added that anyone with access to sensitive intellectual property can be a target, not only AI companies.
How the approach works
Tian said scammers increasingly use AI to scour websites from Reddit to Pinterest for personal details, then tailor a ploy to one person. Delaney, a former Defense Intelligence Agency officer, said attackers lean on "the oldest tricks in the book: elicitation, flattery, ego."
Her sessions walk employees through the usual progression. "Introduction, then repeated contact, favors, sensitive requests — the secrecy, the pressure," she said. Bad actors may mine anything you post online to find an interest to mirror, or an acquaintance who can make an introduction.
Delaney has worked with Fortune 500 companies such as Uber and Merck, advising on cybersecurity risks and building training programs.
Trust the gut feeling
In many cases, Delaney said, targets sense something is off but would rather believe the interest is real. Her advice is to rely on self-awareness, common sense and the ability to recognize situations that feel too good to be true.
"The bottom line is, we're all human," she said. "It feels so good to be wanted, or to be respected, or to be appreciated, or loved."
