Social Engineering
Social engineering is a set of psychological manipulation techniques used by cybercriminals to persuade people to reveal confidential information or perform specific actions that compromise security.
Social Engineering Definition
Social engineering is a set of psychological manipulation techniques used to persuade people to perform specific actions or reveal confidential information. In the context of cybersecurity, social engineering is often used by attackers to gain unauthorized access to systems, data, or organizational resources by exploiting human psychology rather than technical security vulnerabilities.
Social engineering — what is it? NIST describes social engineering as deceiving a person into giving away information — a password, for example — that the attacker can then use against systems or networks. In Polish, the term appears both as „socjotechnika” and as „inżynieria społeczna” (a literal rendering of “social engineering”), and the latter is also used in political science for influencing social groups; this entry covers only the information security meaning. We explain how social engineering is used in controlled testing in The role of social engineering in penetration testing.
How Does Social Engineering Work?
Social engineering works by exploiting human emotions, behaviors, and psychological tendencies such as:
- Trust
- Fear
- Greed
- Curiosity
- Sense of duty
- Desire to help others
- Time pressure
Attackers manipulate these traits to persuade victims to take desired actions.
Types of Social Engineering Attacks
-
Phishing: Sending fraudulent emails to extract data.
-
Pretexting: Creating a false scenario to obtain information.
-
Baiting: Luring the victim with a false reward or benefit.
-
Quid pro quo: Offering something in exchange for information.
-
Tailgating: Unauthorized entry to a secured area behind someone else.
-
Vishing: Phone phishing.
-
Impersonation: Pretending to be another person or organization.
How does a social engineering attack unfold?
A classic social engineering attack rarely relies on a single conversation. CISA describes a pattern in which the attacker uses contact with people and their own social skills to gather information about a company and its systems step by step:
- A credible role. The attacker introduces themselves as, say, a new employee, a repair technician or a researcher — sometimes with “proof” backing that identity.
- Small questions. Each conversation seems harmless, but the answers add up to a picture of the organisation: who is responsible for what, which systems are used, how a procedure works.
- More sources. When one person does not reveal enough, the attacker contacts the next one in the same company and refers to what they have already learned — which makes them more credible.
- Getting in. The information collected makes it possible to craft convincing phishing, a phone call (vishing) or a text message (smishing) and gain access.
Phishing is therefore one form of social engineering. In MITRE ATT&CK, every variant of phishing is social engineering delivered over an electronic channel (technique T1566), and its sub-techniques cover an attachment, a link, a message via a third-party service such as a social network, and a voice call.
Goals of Social Engineering
- Obtaining confidential information (e.g., passwords, personal data)
- Access to secured systems or areas
- Installing malware
- Identity theft
- Extorting money
- Industrial espionage
- Sabotage
Social Engineering Attack Examples
- Email from “IT department” asking to change password by clicking a link
- Phone call from “bank” asking to confirm account details
- USB drive with malware left in a public place
- Fake employee trying to gain physical access to the office
Social Engineering and Cybersecurity
Social engineering poses a serious threat to cybersecurity because:
- It exploits the “weakest link” - humans
- It can bypass advanced technical security measures
- It is difficult to detect by traditional security systems
- It constantly evolves, adapting to new technologies and trends
How to Recognize a Social Engineering Attack?
- Unexpected requests for confidential information
- Time pressure or threats
- Offers too good to be true
- Unusual or suspicious requests from “supervisors”
- Requests to bypass standard security procedures
- Inconsistencies in communication (e.g., language errors, strange email addresses)
Protection Methods Against Social Engineering
- Employee education and training
- Implementing strong security policies
- Verifying caller identity
- Caution when opening attachments and links
- Regular security audits
- Using multi-factor authentication
- Cultivating a security culture in the organization
CISA’s first recommendations are to be suspicious of unannounced calls, visits and emails asking about employees or internal matters, and to verify a caller’s identity directly with the company they claim to represent — not through a number or address given in the suspicious message. Whether these rules work in practice is best checked on a live team: sociotechnical tests are controlled simulations of phishing campaigns, phone attacks, attempts to physically enter the office and pretexting scenarios.
Consequences of Successful Social Engineering Attacks
- Loss of confidential data
- Financial losses
- Privacy breaches
- Organizational reputation damage
- Business operation disruption
- Costs related to incident response and damage repair
- Potential legal consequences
Social Engineering Trends 2025-2026
AI-Powered Attacks
Artificial intelligence enhances social engineering:
- Deepfake audio: Voice cloning for vishing attacks
- Deepfake video: Fake video calls from “CEO”
- AI-generated phishing: Highly personalized, grammatically perfect messages
- Real-time translation: Attacks crossing language barriers
Business Email Compromise (BEC) 2.0
More sophisticated BEC attacks:
- Compromised mailbox monitoring before attack
- Perfect timing and context
- Multi-channel coordination (email + phone)
- Cryptocurrency and wire fraud
Related Terms
- Phishing - most common social engineering attack type
- Vishing - phone-based phishing
- Spear Phishing - targeted phishing
- Security Awareness - protection against social engineering
Explore Our Services
Want to protect your organization against social engineering? Check out:
- Social Engineering Testing - employee resilience verification
- Security Awareness Training - building threat awareness
- SOC 24/7 - detecting social engineering attempts
Social engineering remains one of the most effective tools in cybercriminals’ arsenal. Effective defense against social engineering attacks requires a combination of education, awareness, and appropriate security procedures to protect both individuals and organizations from manipulation and fraud.
Frequently asked questions
+ What is social engineering in simple terms?
Social engineering is the psychological manipulation of people to make them reveal confidential information, transfer money, install malware, or take other actions that benefit the attacker. Where technical attacks exploit software vulnerabilities, social engineering exploits human psychology — trust, urgency, fear, helpfulness, authority. Verizon DBIR 2025 attributes ~36% of breaches to social engineering. Famous examples: Twitter Bitcoin scam (2020), Uber breach (2022), MGM Resorts ransomware (2023), Hong Kong deepfake CFO transfer ($25M, 2024). In 2024-2026, AI tools (voice cloning, deepfakes, AI-written phishing) have dramatically increased the scale and sophistication of social engineering.
+ What are the main types of social engineering?
Eight common techniques: (1) **Phishing** — malicious emails impersonating trusted senders, (2) **Spear phishing** — personalised phishing targeting specific individuals, (3) **Whaling** — phishing aimed at executives, (4) **BEC (Business Email Compromise)** — fraudulent wire transfer requests via spoofed or compromised executive emails, (5) **Vishing** — voice phishing over the phone, (6) **Smishing** — SMS phishing, (7) **Pretexting** — invented scenario to extract information (impersonating IT support, vendor, auditor), (8) **Baiting** — leaving malicious USB drives or downloads where targets find them. Other variants: tailgating (physical follow-in), quid pro quo (offering something for information), watering hole (compromising sites the target visits).
+ What psychology principles do social engineers exploit?
Robert Cialdini's six principles of influence underpin most social engineering: (1) **Authority** — claiming to be IT, police, executive, regulator, (2) **Urgency / scarcity** — 'your account will be closed in 24 hours', 'limited time offer', (3) **Reciprocity** — small favour creates psychological pressure to return, (4) **Social proof** — 'everyone is doing it', 'your colleagues already complied', (5) **Commitment / consistency** — small initial agreement leads to bigger asks, (6) **Liking** — personalised, friendly tone. Plus exploitation of emotions: **fear** (compliance violations, account compromise), **greed** (lottery, investment scams), **curiosity** (clickbait, leaked documents), **helpfulness** (fake support requests). Effective defences require both technical controls and ongoing user awareness.
+ How is AI changing social engineering in 2026?
AI has transformed social engineering at scale: (1) **AI-generated phishing** — ChatGPT, Claude, Gemini write grammatically perfect phishing in any language, eliminating language flaws that flagged many attacks, (2) **Voice cloning** (ElevenLabs, similar) — realistic vishing using a short sample of public audio of an executive, (3) **Deepfake video** — Hong Kong 2024 case: finance worker transferred a huge sum after deepfake video conference impersonating the CFO, (4) **Automated personalisation** — AI scrapes LinkedIn and corporate websites at scale, enabling spear phishing for the price of mass phishing, (5) **Conversational phishing** — AI-powered chatbots maintain consistent multi-turn deception. Defences: shift from 'spot the typo' awareness to behaviour-based controls (out-of-band confirmation for any wire transfer, voice/video verification protocols), executive-specific protection programmes.
+ What is BEC (Business Email Compromise)?
BEC is the most damaging form of social engineering, focused on tricking organisations into wire transfers or sensitive data disclosure. Two flavours: (1) **Email account compromise** — attacker actually controls a real executive's mailbox via phishing or password reuse, monitors email patterns, then sends fraudulent transfer requests at the right moment, (2) **CEO impersonation** — attacker spoofs or look-alikes the CEO's email (`ceo@compamy.com` instead of `company.com`) and pressures finance staff with urgency. FBI IC3 reports $2.9B+ in BEC losses in 2024 alone. Defences: domain locking, DMARC enforcement, mandatory out-of-band verification for any wire transfer over a threshold, executive security training, AI-based email anomaly detection (Abnormal, Tessian, Proofpoint Email Fraud Defense).
+ How do you defend against social engineering?
Layered defence — no single control is sufficient: (1) **Phishing-resistant MFA** (FIDO2, passkeys) — eliminates the value of stolen credentials, (2) **Email security** with sandbox detonation and impersonation detection (Defender for O365, Proofpoint), (3) **DMARC at p=reject** — blocks domain spoofing of your own organisation, (4) **User awareness training** with monthly phishing simulations and click-rate metrics — top performers reduce click rates significantly, (5) **Out-of-band verification** for high-stakes actions (wire transfers, password resets, MFA changes), (6) **Reporting button** in email client — fast user reporting + SOC review, (7) **EDR/XDR** to catch malware that slips past email filters, (8) **Incident response plan** for BEC — fast bank and law enforcement contact can recover funds if done quickly.
+ What is the role of security awareness training?
Security awareness training is the human-centred control complementing technical controls. Effective programmes include: (1) **Initial onboarding** — every new employee gets baseline training, (2) **Annual refreshers** — short, scenario-based modules, (3) **Monthly phishing simulations** — measured click rates, immediate education for clickers, (4) **Role-based training** — finance team gets BEC-specific training, executives get whaling awareness, IT gets vendor impersonation, (5) **Microlearning** — short videos, gamified modules, (6) **Simulated incidents** — tabletop exercises and red-team-style social engineering tests. Top platforms: KnowBe4, Proofpoint Security Awareness, Hoxhunt, Mimecast Awareness, Living Security. Effectiveness: well-run programmes significantly reduce successful phishing; without consistent reinforcement, awareness decays within months.
+ Is social engineering also a political science term?
Yes — the phrase is also used in political science for influencing the behaviour of social groups. In cybersecurity it means something narrower: manipulation aimed at getting a person to reveal information or take an action that benefits the attacker. In Polish, the cybersecurity meaning is expressed as „socjotechnika” or „inżynieria społeczna”, and when the context is phishing, vishing or pretexting, the terms are used interchangeably.
+ Is phishing social engineering?
Yes. Phishing is a form of social engineering carried out over an electronic channel — in MITRE ATT&CK (technique T1566) every variant of it is described as electronically delivered social engineering. Its sub-techniques cover an attachment, a link, a message via a third-party service such as a social network, and a voice call. Social engineering also includes methods without email, such as a phone call, an office visit or impersonating an employee.