Social engineering
Also known as: human hacking, pretexting, tailgating, manipulation attack
Social engineering is the art of tricking people rather than hacking machines.
Attackers exploit human instincts (trust, fear, urgency, the desire to be helpful) to get someone to reveal a password, let them into a building, or approve a payment. It underpins phishing, BEC, and many real-world breaches.
Social engineering, explained at three levels
At home
A con artist doesn't pick the lock; he talks you into handing over the key. Social engineering is that same trick applied to security. Instead of breaking into a computer, the attacker manipulates a person, using friendliness, authority, or panic to get a password, a payment, or a door held open. The technology can be perfectly secure while the human holding it is persuaded to bypass it.
At work
Social engineering is any attack that manipulates people rather than systems. Attackers impersonate IT staff, suppliers, executives, or customers to get employees to reveal credentials, approve payments, install software, or let them into a building. It matters to a business because it underpins phishing, BEC, and many breaches, and it bypasses technical controls by working through staff who are already trusted.
At home
Most social engineering pulls a handful of psychological levers: authority (I'm from the bank), urgency (your account closes today), fear, helpfulness, and trust in the familiar. Common techniques include pretexting, which invents a believable story; baiting, such as a USB stick labelled 'payroll' left in a parking lot; and tailgating, following someone through a locked door. Each one works by rushing you past the moment where you would normally check.
At work
A typical workplace attack starts with reconnaissance. The attacker gathers names, titles, vendors, and internal jargon from LinkedIn, the company website, and press releases. They then build a pretext, such as a new IT contractor or a supplier's accounts clerk, and choose a channel: email, phone, text, or a visit. The request is usually small and plausible, like resetting a password or confirming an address, because small requests rarely trigger verification.
At home
Skilled social engineers chain small disclosures. One call to reception confirms a manager's name, a second to the help desk uses that name to request a password reset, and a third uses the new access. Each step looks harmless on its own. AI voice cloning now makes impersonation easier still. While awareness helps, in my view the real fix is verifying who is asking at every step, not just what they ask for.
At work
Because social engineering targets people, controls must remove single-person trust decisions. Help desks should verify identity before any password or MFA reset, through a callback or manager approval, the gap exploited in the 2023 MGM Resorts breach. Finance needs dual approval for payments. Physical security needs visitor sign-in and badge checks. AI-generated voice and video deepfakes mean recognizing a voice is no longer proof, so code words and callbacks to directory numbers are essential.
Real-world examples
At home
Lena got a phone call from someone claiming to be her bank's fraud team, who 'just needed to verify' her online banking code to stop a suspicious charge. Real banks never ask for that code. She hung up and called the number on the back of her card: there was no fraud alert.
At work
Jerome's clinic received a caller posing as a printer technician who needed the Wi-Fi password to 'run diagnostics.' Staff had been trained that no legitimate vendor needs network credentials by phone. They took a name and callback number; the 'technician' hung up.
Common confusions
- Social engineering only happens over email — It happens by phone, text, in person, and over social media. Any channel where a human can be persuaded is a potential vector.
- Smart, careful people can't be fooled — Social engineers exploit universal instincts and manufacture pressure that clouds judgment. Anyone can be caught off guard, which is why process-based verification beats relying on individual vigilance.
- Better technology will solve it — Technology helps, but social engineering deliberately bypasses technology by targeting people. Training and verification culture are essential complements.
For analysts
Build a culture where verifying a request is normal and reporting a suspected scam is rewarded, never mocked. The businesses that resist social engineering are the ones where 'let me confirm that through another channel' is a routine, expected response.
History & origin
Social engineering predates computers (con artists have always exploited trust) but it became a security discipline as famous hackers demonstrated that the easiest way past technical defences was often to simply ask an employee. As organizations hardened their technology through the 2000s and 2010s, attackers shifted focus to people, making awareness training a core part of security programs.