Social Engineering Attacks: Baiting, Pretexting, Tailgating and Other Manipulation Techniques

Social engineering is the art of manipulating people to obtain confidential information or access to systems. While phishing is the most discussed technique, cybercriminals have a much broader arsenal of methods. This article presents advanced social engineering techniques and ways to defend against them.

What Are Social Engineering Attacks?

Definition

Social engineering attacks are psychological manipulation methods that exploit human behaviors, emotions, and weaknesses to bypass technical security measures. Instead of breaking systems, attackers “break” people.

Psychological Foundations

Social engineering attacks exploit fundamental characteristics of human psychology:

Trait	Exploitation
Trust	Impersonating authorities
Fear	Threats and urgency
Greed	Promise of rewards
Curiosity	Baits and intriguing content
Helpfulness	Requests for favors
Laziness	Shortcuts
Social pressure	Conformity and obedience

📚 Read the complete guide: SOC: Security Operations Center - what it is, how it works, how to choose

Baiting - Lure Attacks

What is Baiting?

Baiting is a technique involving leaving a physical or digital “lure” designed to entice the victim into taking dangerous action.

Physical Baiting

USB Drives:

Classic scenario:
1. Attacker leaves infected USB drives in company parking lot
2. Curious employee finds drive labeled "Salaries 2024"
3. Connects to work computer
4. Malware automatically installs
5. Attacker gains access to corporate network

Effectiveness: In studies, 45-98% of found USB drives are connected to computers.

Other physical baits:

• CD/DVDs with attractive labels
• External hard drives
• Memory cards
• Fake charging stations (Juice Jacking)

Digital Baiting

Fake downloads:

Example baits:
├── "Free Office 365 - download now!"
├── "Exclusive music - unreleased tracks"
├── "Software cracks and keygens"
├── "Movies before premiere"
└── "V-bucks / cryptocurrency generator"

Malvertising:

• Malicious ads on legitimate sites
• Fake “Download” buttons
• Pop-ups with “prizes”

Protection Against Baiting

1. USB Policy - block unauthorized devices
2. Training - threat awareness
3. Endpoint Protection - USB device scanning
4. DLP - data transfer monitoring
5. Physical security - access control

Pretexting - False Pretext

What is Pretexting?

Pretexting is a technique involving creating a false scenario (pretext) to gain the victim’s trust and extract information.

Anatomy of a Pretexting Attack

Pretexting phases:
1. RECONNAISSANCE
   ├── Gathering company information (LinkedIn, website)
   ├── Identifying organizational structure
   └── Learning jargon and procedures

2. BUILDING THE PRETEXT
   ├── Creating a credible story
   ├── Preparing false identity
   └── Preparing materials (business cards, documents)

3. EXECUTION
   ├── Contacting the victim
   ├── Building rapport and trust
   └── Extracting information/access

4. EXPLOITATION
   └── Using obtained information

Typical Pretexting Scenarios

1. Fake IT Employee:

Attacker: "Good morning, I'm calling from IT helpdesk.
We have a security alert on your account and I need
to verify a few things. Can you give me your login
and password so I can check the settings?"

2. Fake Auditor:

"I'm from an auditing firm conducting a GDPR
compliance review. I need access to the HR system
to verify procedures."

3. Fake Supplier:

"I'm calling from [well-known courier company]. We have
an urgent delivery, but the system shows incorrect data.
Can you confirm the address and recipient details?"

4. Fake Boss (CEO Fraud):

Email from "director": "I urgently need to transfer
funds to a contractor's account. Confidential matter,
don't inform anyone. Please execute immediately."

Pretexting Red Flags

Warning Signal	Description
Urgency	”This is urgent, I need it immediately”
Threats	”If you don’t help, there will be consequences”
Data requests	Questions about passwords, numbers, personal data
Avoiding verification	”I don’t have time for procedures”
Strange channels	Contact from unusual numbers/addresses
Too many details	Excessive explanation of their story

Protection Against Pretexting

1. Verification procedures - callback to official numbers
2. Two-person rule - confirmation for sensitive operations
3. Scenario training - attack simulations
4. “Need to Know” policy - limited information access
5. Security culture - encouraging reporting of suspicions

Tailgating and Piggybacking

What is Tailgating?

Tailgating is a technique of physically entering a secured area by following an authorized person without using one’s own credentials.

Difference: Tailgating vs Piggybacking

Tailgating	Piggybacking
Victim doesn’t know they’re letting in intruder	Victim knowingly lets in intruder
Attacker enters unnoticed	Victim holds door “out of courtesy”
Exploits inattention	Exploits social norms

Tailgating Scenarios

1. “Hands Full”:

Attacker approaches door with boxes/coffee,
simulating full hands. Employee holds door
"out of courtesy".

2. “Urgent Matter”:

Attacker talks on phone, looking stressed.
"Sorry, I have an urgent meeting, lost my card..."

3. “New Employee”:

"First day at work, don't have my pass yet.
HR said I'd get it after lunch. Can you let me in?"

4. “Service Technician”:

Attacker in technician uniform from "service company"
claims to have a scheduled visit. Employee lets them
in because "they have a uniform".

Protection Against Tailgating

Physical safeguards:

• Security vestibules (mantraps)
• Turnstiles
• Card readers with people counting
• Cameras at entrances

Procedural safeguards:

• “One person - one passage” policy
• Guest escorting
• Visitor badge system
• Tailgating recognition training

Cultural safeguards:

• Encouraging stopping strangers
• No penalties for “impoliteness”
• Rewarding vigilance

Other Social Engineering Techniques

Quid Pro Quo

Definition: Offering something in exchange for information or action.

Example:
Attacker calls multiple employees, posing as
IT support: "We heard about computer problems.
I can help if you give me your login credentials
for remote diagnostics."

Vishing (Voice Phishing)

Definition: Phishing via phone.

Typical vishing scenarios:
├── "Bank" informing about suspicious transaction
├── "Police" calling for cooperation
├── "Microsoft" warning about viruses
├── "Tax Office" threatening penalty
└── "Grandchild" urgently needing money

Smishing (SMS Phishing)

Definition: Phishing via SMS.

Smishing examples:
├── "Your package is waiting. Pay $2: [link]"
├── "Log into your bank: [fake link]"
├── "You won an iPhone! Claim: [link]"
└── "Your account will be blocked: [link]"

Watering Hole

Definition: Infecting sites frequently visited by the target.

Watering hole attack process:
1. Identify sites visited by company employees
2. Compromise one of these sites
3. Place malware or exploit
4. Employees visit the site and get infected
5. Attacker gains access to company network

Dumpster Diving

Definition: Searching through trash for information.

What can be found:
├── Printed documents
├── Notes with passwords
├── Organizational charts
├── Contact lists
├── Discarded storage media
└── Invoices and financial documents

Shoulder Surfing

Definition: Looking over someone’s shoulder while they enter data.

High-risk locations:
├── ATMs
├── Coffee shops (remote work)
├── Public transport
├── Open office spaces
└── Airports and hotels

Organizational Protection

Security Awareness Program

Elements of an effective program:

1. Regular training

   • Not just one-time
   • Various formats (video, interactive, games)
   • Role-appropriate

2. Attack simulations

   • Phishing simulations
   • Vishing tests
   • Physical penetration tests
   • Red team exercises

3. Continuous communication

   • Security newsletter
   • Posters and reminders
   • Current threat alerts

4. Measuring effectiveness

   • Click rate in simulations
   • Incident reporting
   • Knowledge tests

Procedures and Policies

Key policies:
├── Caller identity verification
├── Password reset procedure
├── Clean desk policy
├── Guest escorting rules
├── Incident reporting procedure
└── Information sharing policy

Supporting Technical Safeguards

Area	Solution
Email	Anti-spam filters, DMARC, sandboxing
Phone	Caller ID verification, blacklists
Physical	Access control, CCTV, alarms
Endpoint	EDR, DLP, USB control
Network	Segmentation, monitoring

Responding to Social Engineering Incidents

When an Employee Falls Victim

Response procedure:
1. DON'T PUNISH - encourage reporting
2. Gather information about the attack
3. Assess scope of compromise
4. Take remedial action
   ├── Password reset
   ├── System scanning
   └── Notify other potential victims
5. Document the incident
6. Conduct lessons learned
7. Update training

Building a Security Culture

Principles:

• Security is everyone’s responsibility
• Asking = OK, silence = risk
• Better to be cautious than sorry
• Reward vigilance, don’t punish mistakes
• Example comes from the top (management)

Summary

Social engineering attacks remain the most effective method of compromising organizations because they target the weakest link - humans. Effective defense requires:

• Awareness - knowledge of techniques and warning signs
• Procedures - clear verification and action rules
• Culture - environment encouraging vigilance
• Technology - tools supporting people
• Continuity - regular training and simulations

Remember: even the best technical safeguards are worthless if an attacker convinces an employee to bypass them. Investment in security awareness is one of the most effective forms of protection.

---

Want to test your organization’s resistance to social engineering attacks? Contact us - we’ll conduct simulations and training that will genuinely increase security.

Related Terms

Learn key terms related to this article in our cybersecurity glossary:

• Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
• SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
• Social Engineering — Social engineering is a set of psychological manipulation techniques used by…
• Social Engineering Testing — Social engineering testing is a method of assessing organizational security…
• Network Security — Network security is a set of practices, technologies, and strategies aimed at…

---

Learn More

Explore related articles in our knowledge base:

• What Are Social Engineering Tests and How Do They Work? - Techniques, Benefits, Tools, and Legal Regulations
• Social Engineering in Cybersecurity: How Hackers Manipulate People
• Social engineering tests: are your employees an unwitting gateway for cybercriminals?
• Key CISO challenges in 2025: from alert fatigue to budget pressure
• Anatomy of a cyberattack on banking: from phishing to advanced frauds

---

Explore Our Services

Need cybersecurity support? Check out:

• Social Engineering Tests - phishing and social engineering simulations
• Cybersecurity Training - employee security awareness

---

Related services and products

• Professional WiFi Network Implementation
• Extreme Networks Switches
• FortiSwitch