Loading page
About this tool
Checklists and explainers for ATM skimmers, public Wi-Fi, hotel room tech, coworking spaces, juice jacking, tailgating, WhatsApp group admin scams and callback verification.
Pick the situation and work through what to check, so a scam or snooping attempt is spotted before it works. This page brings together 8 separate social engineering safety guide pages (ATM skimmer, Callback verification, Coworking space, WhatsApp group admin scam, Hotel room, Juice jacking, Public Wi-Fi, Tailgating) so you can compare them without hunting for the right one.
Open Social Engineering Safety Guide on AltFTool — it loads instantly in your browser.
Choose your situation at the top: ATM skimmer, Callback verification, Coworking space, WhatsApp group admin scam and 4 more. On a phone it is a drop-down list.
Fill in the social engineering safety guide for that situation; each of the 8 options keeps its own rules, data and defaults.
Read the result, then switch situation to compare. The page link keeps your situation (?v=atm-skimmer-checklist), so you can bookmark or share it.
ATM skimmer, Callback verification, Coworking space and the rest sit behind one picker, so switching situation takes a tap instead of a new search.
Every situation keeps its own rules, numbers and defaults rather than one generic template.
The link remembers the situation you picked, so a bookmark or a shared link opens straight on it.
8: ATM skimmer, Callback verification, Coworking space, WhatsApp group admin scam, Hotel room, Juice jacking, Public Wi-Fi, Tailgating. Pick one at the top of the tool; the page link updates (for example ?v=atm-skimmer-checklist) so you can bookmark or share that exact view.
Grip the card slot and pull: factory hardware is bolted through the fascia and will not move, while an overlay skimmer is glued on and wobbles, lifts or comes away. Then press a corner of the keypad — an overlay flexes — and look for a pinhole, mirror or extra panel above or beside the keypad, plus a leaflet holder angled down at the keys, which is a lower-severity but still worth checking sign.
It is a number you obtained yourself from a source the organisation gave you — the back of your card, your statement, the signed-in app, or a branch — and which you dial after ending a suspicious call. Using it defeats caller-ID spoofing, because you control which line you connect to rather than trusting the one that rang you.
People with legitimate access to the same floor — which makes an unlocked screen and an unattended laptop the two highest-impact gaps. A one-minute auto-lock plus full-disk encryption covers the majority of realistic loss scenarios, well before anything network-related matters.
Check the phone number against the group's participant list and look for the system message WhatsApp posts whenever an admin is added — a real promotion always leaves that line in the chat history. Impersonators copy the display name and photo but cannot fake either of those, which is why they move the conversation into a private DM.
Yes. Every in-room safe has an override — a master code, a mechanical key or an electronic audit device — because guests forget their codes. Use it against opportunistic theft, always set your own code instead of leaving the factory default, and keep a passport or irreplaceable item on you rather than in the room.
It is a demonstrated technique with genuine public advisories from the FBI and FCC, but publicly documented cases of real victims remain scarce. The realistic modern version is a tampered cable left hanging at a charging point rather than the wall socket itself, and it still needs your phone to grant data access.
Far less than the old advice suggests, because almost all traffic is HTTPS and browsers now block or flag plain HTTP. The remaining risks need you to act: accepting a certificate warning, entering real credentials into a fake portal, installing a profile or app the portal asks for, or joining an evil-twin network with a copied name.
It is entering a controlled area by following an authorised person through the door, without presenting your own credential. Piggybacking is the variant where the authorised person knowingly holds the door open; both defeat a badge reader because the reader only counts authorisations, not bodies.