What Is Social Engineering? Types, Examples & Prevention Solutions
A phone call, a text about an expired password or a message that looks like it came from your boss does not need to break any software to cause damage. It only needs one person to trust the wrong request at the wrong moment. In 2025 the FBI's Internet Crime Complaint Center received 1,008,597 complaints with $20.877 billion in reported losses, and phishing and spoofing alone drew 191,561 of them (FBI IC3, 2025 report). This guide explains how social engineering works, how to spot it and how to build defenses that do not depend on perfect human judgment.
TL;DR
Social engineering manipulates people into sharing information, granting access, approving payments or running malicious software. It targets decisions, not just code.
Phishing is one type. Others include vishing, smishing, pretexting, business email compromise, tailgating, MFA fatigue and deepfake impersonation.
Common warning signs are urgency, secrecy, channel-switching and requests to bypass normal process. Polished wording proves nothing.
Layered defenses work best: phishing-resistant sign-in, verification workflows, least privilege, filtering, a no-blame reporting culture and a rehearsed response plan.
Training alone cannot stop every attempt, and no assessment guarantees security. Limit what one deceived person can cause.
What Is Social Engineering?
Social engineering is the use of deception and psychological pressure to make people reveal information, grant access, approve payments or take other harmful actions. Instead of exploiting a software flaw, the attacker exploits trust, urgency or routine. Common forms include phishing, vishing, smishing, pretexting, business email compromise and impersonation using cloned voices or video.
Table of Contents
What Is Social Engineering in Cybersecurity?
Social engineering is manipulation that gets a person to do something that helps an attacker. NIST's glossary collects several definitions; one describes it as an "attempt to trick someone into revealing information (e.g., a password) that can be used to attack systems or networks" (NIST glossary). MITRE ATT&CK lists Social Engineering as technique T1684 and describes adversaries manipulating users into approving changes, disclosing information or running malicious instructions, often leaving few technical indicators (MITRE ATT&CK T1684).
The key contrast is the target. A vulnerability exploit attacks code, such as an unpatched server. Social engineering attacks a decision: whether to click, approve, reset or pay. In practice the two combine. A deceived employee hands over a login, and technical weaknesses then decide how far that login reaches. For wider context, see how a cyberattack unfolds and where cybersecurity fits.
Here is a simple illustrative example. A caller tells a help desk that a traveling manager lost a phone and needs an urgent password reset. No software flaw is involved. The weakness is a process that trusts a confident voice. Goals usually fall into four groups: collecting information, gaining access, moving money, or triggering harmful actions such as installing malware.
Social engineering matters for security programs because it bypasses controls that look strong on paper. Firewalls, encryption and patching all assume the person at the keyboard is acting honestly. When a threat actor persuades that person instead, the attack travels along legitimate paths: a real login, a real approval, a real payment. That is why the topic belongs in every cybersecurity business conversation, not only in IT.
How Does a Social Engineering Attack Work?
Real attacks vary, but most follow a recognizable lifecycle. The attacker researches the target using public profiles, company pages or leaked data. They build a believable pretext, such as an IT notice or supplier request. They add trust or pressure through authority, urgency or familiarity. The target takes an action. Access or money is lost. Finally, someone notices, or does not.
Each stage gives defenders a chance. Research is hard to prevent because much of it uses public information, so limit unnecessary exposure but do not rely on secrecy. The best returns come from stages four to six: make risky actions harder to complete, make stolen access less useful and detect misuse quickly. Treat the lifecycle as a model, not a script. Attackers skip steps, repeat them or switch channels mid-conversation.
A simple attack-to-control map shows where each defense fits:
Research: limit oversharing and watch for lookalike domains.
Pretext: filtering, email authentication and clear internal contact lists.
Trust: teach that authority and urgency are cues to verify, not to comply.
Action: approval workflows, phishing-resistant sign-in and step-up checks.
Impact: least privilege, segmentation and fast session revocation.
Response: logging, alerting and a rehearsed plan.
This map is Articsledge's own synthesis for planning, not independent laboratory research, and real attacks will not always follow it neatly.
Why Does Social Engineering Work?
Attackers borrow from ordinary human psychology. The common levers are:
Authority: a request that appears to come from a boss, bank or regulator.
Urgency and fear: deadlines, threats or "your account will be closed."
Reciprocity: a favor or gift that creates a sense of obligation.
Curiosity and scarcity: a surprising document, prize or limited offer.
Familiarity and social proof: a known name, a real thread or "everyone has already done this."
Workplace conditions help the attacker too. Busy people follow routines quickly, large inboxes create cognitive load, and staff are often rewarded for being helpful and fast. Verizon's 2026 report release notes that mobile-centric social engineering, such as fake texts and voice calls, had a success rate 40% higher than traditional email phishing (Verizon, 19 May 2026). Falling for a convincing request is not a character flaw. Good design assumes honest mistakes will happen and keeps them from becoming incidents.
Three myths slow prevention down. Myth: only careless people are fooled. In reality, a busy day, a convincing pretext and a plausible sender fool experienced staff too. Myth: technology alone will catch it. Filters can miss novel messages and cannot hear a phone call. Myth: attackers always make spelling mistakes. Fluent text is now easy to produce, so the absence of errors proves nothing.
Types of Social Engineering Attacks
These names overlap. One attack may start as a text, move to a phone call and end in payment fraud. Each entry gives the goal, an illustrative scenario, a warning sign and a practical control.
Email phishing. Mass messages that imitate a trusted brand or colleague, such as a fake "storage full" notice. Goal: steal credentials or deliver malware. Sign: mismatched sender, generic greeting, pressure to act. Control: email authentication, filtering and a one-click report button.
Spear phishing. A targeted message using details about one person or team, such as a real project name. Goal: higher-value access. Sign: unexpected request that fits the context too neatly. Control: verify through a separate channel before acting.
Whaling. Spear phishing aimed at executives or their assistants. Goal: authority to approve payments or reach sensitive data. Sign: confidential, urgent requests. Control: assistants and executives follow the same approval rules as everyone else.
Smishing. Phishing by text message, for example a fake delivery fee. Goal: credentials or card details. Sign: unknown number with a short link. Control: never use links in texts; go to the official app or site.
Vishing. Voice calls from a "bank," "IT support" or "tax office." Goal: codes, passwords or remote access. Sign: caller creates urgency and asks you to read out a code. Control: hang up and call back on a number you find yourself.
QR phishing (quishing). A QR code sends you to a fake sign-in page. Goal: credentials. Sign: a code on an unexpected email, sticker or poster. Control: preview the address before opening, and treat codes like links.
Pretexting. An invented scenario that justifies a request, such as an "auditor" needing records. Goal: information or access. Sign: a story that is hard to check. Control: identity checks that do not depend on the caller's own details.
Business email compromise and invoice diversion. Fraudulent or hijacked email asks finance to pay a new account. Goal: money. Sign: changed bank details or an unusual payment request. Control: call back on a known number and require dual approval.
Baiting. Something tempting is left for the victim, such as an unlabeled USB drive or a free download. Goal: malware execution. Sign: unsolicited media or "leaked" files. Control: block unknown devices and download only from official sources.
Quid pro quo. An offer of help in exchange for access, such as a "technician" who fixes a problem if you disable security. Goal: access. Sign: help you did not request. Control: use only support channels you started.
Tailgating or piggybacking. Following someone through a secured door, perhaps carrying boxes. Goal: physical access. Sign: unbadged visitor who relies on politeness. Control: badge policy, escorted visitors and a culture where challenging is normal.
Fake support and help-desk impersonation. Attackers pose as support to victims, or as employees to support staff. Goal: remote access or account recovery. Sign: unsolicited pop-up or call, or a recovery request that bypasses checks. Control: strict identity proofing for resets.
Scareware. A pop-up claims your device is infected and urges a "cleaner." Goal: payment or malware installation. Sign: alarming alerts in a browser. Control: close the tab, run your own security tool and report it.
Messaging and social platform impersonation. A hijacked or cloned account messages contacts asking for money or codes. Goal: payment or account takeover. Sign: friend or colleague asks for urgent help. Control: confirm by voice or another channel.
MFA push fatigue. Repeated sign-in prompts after the attacker already has a password. Goal: one approval by exhaustion or confusion. Sign: prompts you did not start. Control: deny, report and use phishing-resistant methods; CISA does not count push prompts as phishing-resistant (CISA).
OAuth consent phishing. A fake app asks you to "allow access" to your mailbox or files. Goal: durable access without a password. Sign: unfamiliar app requesting broad permissions. Control: restrict who can approve apps and review granted consents.
Reverse social engineering. The attacker creates a problem, then offers to fix it so the victim asks for help. Goal: trust and access. Sign: a convenient "expert" appears right after a fault. Control: route help requests through official channels only.
Deepfake voice and video impersonation. Synthetic audio or video imitates a known person. Goal: payments or credentials. Sign: urgent, secret requests even when voice and face seem right. Control: call back on a known number and require a second approver.
Channel, technique and outcome matrix
Channel | Typical techniques | Typical outcome | Key control |
Phishing, spear phishing, BEC | Stolen logins, diverted payments | Authentication, filtering, call-back checks | |
SMS and messaging | Smishing, impersonation | Credential theft | Official apps, reporting |
Phone and video | Vishing, deepfakes, fake support | Codes, payments, remote access | Call-back, dual approval |
In person | Tailgating, baiting | Physical access, malware | Badges, escorts, device policy |
Sign-in flows | MFA fatigue, OAuth consent | Account takeover | Phishing-resistant MFA, app consent limits |
Social Engineering Examples: Everyday and Business Scenarios
The scenarios below are illustrative and invented for teaching. They are not real incidents, and they contain no working links or scripts.
Payroll change. An email that appears to come from an employee asks payroll to move salary to a new account before Friday. Red flag: a payment-detail change by email with a deadline. Verify: call the employee using a number from the HR system. Respond: hold the change and report the message.
Fake password-reset text. A text says your password expires today and links to a sign-in page. Red flag: an unexpected link and a deadline. Verify: type the official address or use a saved bookmark. Respond: report it, and if you entered credentials, tell IT at once.
Compromised supplier thread. In a genuine email thread, a supplier's contact announces new bank details because the supplier's mailbox was taken over. Red flag: banking changes mid-thread. Verify: phone a contact from your own records. Respond: pause the payment and alert the supplier.
Executive payment demand. A message from the "CEO" asks a finance assistant to wire funds and keep it confidential. Red flag: secrecy and skipped approval. Verify: reach the executive through a known channel. Respond: refuse and report.
Parcel text. A text claims a parcel is held and asks for a small redelivery fee. Red flag: unexpected small payment through a link. Verify: use the carrier's official app or site. Respond: delete it and report it to your carrier.
QR login prompt. A sticker in a meeting room says "scan for guest Wi-Fi" and then asks for work credentials. Red flag: a hidden destination and a credential request. Verify: ask IT or reception. Respond: remove the sticker and report it.
Help-desk recovery call. A caller says they changed phones, cannot receive their MFA code and needs the authenticator reset now. Red flag: a recovery request that tries to skip normal identity checks. Verify: follow the written proofing steps, including a call-back to the number on file or manager confirmation. Respond: decline until proofing is complete and log the attempt.
Deepfake call. A video call shows a familiar executive requesting an urgent confidential transfer. Red flag: urgency and secrecy, even when face and voice seem right. Verify: end the call and phone back on a known number. Respond: require a second approver and report it.
Real-World Social Engineering Incidents and Lessons
Four documented cases show different parts of the problem. Each summary separates what the primary source confirms from what remains uncertain.
Twilio, 2022: text-message phishing. Twilio's incident report says texts posed as IT staff, claimed passwords had expired and led to lookalike sign-in pages, and some employees entered credentials. Twilio reports access to internal tools, 209 affected customers out of more than 270,000 and 93 Authy users out of about 75 million, with no evidence that console credentials, authentication tokens or API keys were accessed. A separate voice-phishing call on 29 June 2022 was contained within 12 hours, and the investigation concluded on 27 October 2022. Uncertain: how many staff were deceived, which Twilio describes only as "some." Lesson: Twilio later gave all employees FIDO2 security keys, pointing to phishing-resistant sign-in and tighter admin tooling (Twilio).
Cloudflare, 2022: a similar attack, blocked. Cloudflare's 9 August 2022 post says at least 76 employees received the texts and three entered credentials, yet the attacker could not sign in because every employee uses a FIDO2 hardware key bound to the real site. Cloudflare reset the credentials, ended sessions and worked with providers to take down the attacker's infrastructure, and says the campaign also targeted other organizations, including Twilio. Lesson: assume someone will be fooled and make the stolen password insufficient (Cloudflare).
MGM Resorts, 2023: disruption, method not confirmed. MGM said on 12 September 2023 that it had identified a cybersecurity issue. Its SEC filing dated 5 October 2023 says it shut down systems, estimated a negative impact of about $100 million on September adjusted property EBITDAR and believed insurance would cover the financial impact of the disruption. The filing mentions unauthorized third-party activity but does not describe the method, so public theories about help-desk impersonation are unconfirmed there. Lesson: whatever the entry route, recovery workflows and rehearsed containment limit the blast radius (SEC Form 8-K).
Arup, 2024: deepfake video call. Fortune reported on 17 May 2024 that Arup confirmed fake voices and images were used in a fraud against its Hong Kong office, which sent about HK$200 million ($25.6 million) in 15 transactions after a video call with imitations of senior colleagues. The employee checked with the UK head office and uncovered the fraud. Arup said none of its internal systems were compromised. Uncertain: the reported details do not explain how the call was arranged. Lesson: no technical break-in was needed, so require out-of-band verification and dual approval for payments (Fortune).
Warning Signs: How to Recognize Social Engineering
No single sign is proof, but these patterns deserve a pause:
A request to change payment details or send money quickly, especially with secrecy.
A request for passwords, one-time codes or recovery codes.
Unusual urgency, threats or an offer that seems too good.
Pressure to move from email to a private chat or phone call.
A request to bypass policy or approval "just this once."
A sender name that looks right while the address, domain or reply-to differs.
An MFA prompt you did not start.
An unexpected request to install software or allow remote access.
A login page or QR code reached through an unexpected message.
Polished wording, real logos, genuine names and authentic-looking email history do not prove legitimacy. Judge the request, not the packaging.
When something feels off, use a simple routine: pause, verify and report. Pause before clicking, paying or sharing. Verify through a channel you control, never the one the message supplied. Report the attempt even if you did nothing, because it may be one of many sent to your colleagues, and early reports help security teams use AI-assisted threat detection and manual review to spot a campaign.
Social Engineering vs. Phishing, Malware, Scams, and Hacking
Term | What it means | Needs a technical exploit? | Relationship |
Social engineering | Manipulating people into harmful actions | No | The umbrella category |
Phishing | Deceptive messages by email, text or voice | No | A form of social engineering; MITRE tracks it as T1566 |
Malware | Malicious software | Often | Can be delivered through social engineering |
Scam or fraud | Deception for financial gain | No | Often uses social engineering |
Hacking | Unauthorized access to systems | Not always | May start with deception or a software flaw |
The overlaps matter. Phishing is a form of social engineering, and MITRE's phishing technique T1566 covers email, link, service and voice variants. Malware can be delivered by a deceived user, and ransomware often arrives that way, but not all social engineering involves malware or any exploit at all.
Who Is Targeted and What Are the Business Risks?
Attackers go where authority, money or access sit. Finance teams approve payments. HR holds payroll and personal data. Executives carry authority. Support teams reset accounts. Administrators hold privileged access. Contractors and suppliers use trusted channels. Small organizations often have fewer controls, while large ones offer more people and systems to probe.
Size changes the shape of the risk, not its existence. A small organization may have one person who both approves payments and manages the mailbox, so a single convincing message can finish the job. A larger one has formal controls but more departments, vendors and cybersecurity infrastructure to keep consistent, and attackers look for the weakest process, such as an overstretched help desk or a rarely used supplier portal.
Business risks include fraud losses, stolen credentials and data, operational disruption, reputational harm, recovery costs and legal duties. Those duties vary by jurisdiction. Some regimes, such as the EU's NIS2 Directive, add security and incident-reporting obligations for covered organizations, so check your own rules.
The IC3 data gives a sense of scale, with a caveat: these are complaints and reported losses, not every incident. In 2025 it recorded 24,768 business email compromise complaints with $3,046,598,558 in losses, and 47,794 tech and customer support fraud complaints with $2,134,675,818 in losses. Verizon's 2026 release says breaches involving a third party reached 48% of all breaches (Verizon), a reminder that supplier relationships widen the trust surface. Preventing data leakage starts with limiting who can be persuaded to share what.
How Individuals Can Prevent Social Engineering
Verify requests through contact details you find yourself, never the ones in the message.
Use passkeys or phishing-resistant MFA where available, and a password manager everywhere else.
Never share one-time codes or recovery codes with anyone.
Treat unsolicited calls, texts, QR codes and prompts with skepticism, however urgent.
Open sites by typing the address or using a saved bookmark.
Keep devices and apps updated.
Share less publicly about your job, travel and family; attackers use it to sound credible.
Report suspicious messages promptly, even if you are unsure.
Households face the same tricks with different targets: a parcel text, a bank call, a message from a relative whose account was hijacked. Agree on a family code word for emergency money requests, and keep recovery codes offline where only you can reach them. If a call or message pushes you, hang up and take control of the next step yourself.
How Organizations Can Prevent Social Engineering
The UK NCSC describes four layers of defense against phishing (NCSC phishing guidance). They work as a model for social engineering more broadly.
Layer 1: make it hard for attackers to reach people. Publish SPF, DKIM and DMARC records (RFC 7208, RFC 6376, RFC 7489), filter inbound mail and limit the information you expose publicly.
Layer 2: help people spot and report. Offer role-based awareness and an easy report button. NCSC says no training can teach users to spot every phishing attempt, warns that blaming users erodes trust, and recommends measuring reports as well as clicks. Read more on phishing simulation software before buying.
Layer 3: limit the effect of what gets through. Use phishing-resistant MFA, least privilege, endpoint protection and sound network security.
Layer 4: respond quickly. Keep security logs, alert on misuse and practice your incident response plan, supported by SIEM and threat detection and response.
Beyond the four layers, add governance. Name an owner for social engineering risk. Write approval workflows for sensitive actions: verify payment-detail changes by calling back a known number and require dual approval. Make help-desk recovery strict, with identity proofing that cannot be satisfied by a convincing voice alone. Add supplier checks, badge and visitor rules against tailgating, and a firewall and audit trail that support investigation. Frameworks such as the NIST Cybersecurity Framework help organize this work. Training alone is not enough, and neither is automated filtering. Both fail sometimes, which is why the layers matter.
Measure what you want more of. Useful indicators include the share of staff who report suspicious messages, the time between a report and the security team's response, the proportion of payment-detail changes verified by call-back and the number of privileged accounts using phishing-resistant sign-in. Review them with leadership alongside existing governance reporting, such as cloud governance and cloud compliance reviews, and revisit them after every incident or near miss.
Technical Controls That Limit Damage After Deception
When deception works, the question becomes what a stolen identity can do. These controls shape the answer:
Strong authentication: phishing-resistant methods such as FIDO/WebAuthn, which CISA lists as phishing-resistant, unlike SMS, voice, one-time-code and push methods.
Authorization on every request: object-level and function-level checks so a valid user cannot reach another user's or tenant's data. OWASP's 2023 API Security Top 10 puts broken object level authorization first (OWASP).
Tenant separation: clear boundaries in multi-tenant and B2B SaaS systems.
Session and token hygiene: short lifetimes, narrow scopes and fast revocation.
Step-up checks: re-authentication or approval before payout changes, exports or role grants.
Rate limits and monitoring: to slow abuse and make it visible.
Business-logic protection: OWASP also lists unrestricted access to sensitive business flows as a risk.
Here is an illustrative chain. An attacker phishes a support agent's session. If the application checks authorization on every request, the session reaches only that agent's tickets. If a data export or payout change then needs step-up verification, a stolen session is still not enough. Each control turns a possible breach into a contained event. Teams that ship quickly with infrastructure as code and DevOps pipelines can encode many of these checks so they apply consistently, and network isolation such as a virtual private cloud limits where a compromised identity can travel.
These matter wherever you expose an API or run cloud security and cloud-native security programs. Authorized testing can check whether such controls hold up. It cannot stop a convincing phone call, and it does not replace training or verification procedures.
What to Do After a Suspected Social Engineering Attack
Act in proportion to what happened, and tell your security team or IT early. Delay helps the attacker.
No interaction: report the message, then delete it.
Opened a link or attachment: tell security immediately and stop using the device; trained staff should isolate it.
Gave credentials: change the password from a clean device, then have staff revoke sessions and tokens and review MFA devices and mailbox rules. A password reset alone does not always end a compromise.
Approved an MFA prompt: report it, revoke sessions and check for newly registered devices.
Installed unauthorized software: isolate the device and leave removal or rebuilding to competent staff.
Transferred money: call your bank at once to request a recall, then report to your national fraud service, such as the FBI's IC3 in the US.
Disclosed business or customer data: preserve evidence and escalate to legal or privacy teams to assess notification duties.
Severity matters. A message deleted unopened needs a report and little else. A credential entered on a fake page needs fast session revocation, because attackers may act quickly. Money sent needs an immediate call to the bank, since speed improves the chance of recovery. Data disclosed needs legal judgment about notification, which varies by country and sector. When in doubt, treat the event as more serious and let the security team downgrade it.
Preserve evidence such as screenshots, message headers and call logs before cleaning up. Recovery planning, including backup and disaster recovery, decides how quickly you resume work.
Social Engineering Prevention Solutions: What to Buy and What to Fix First
Solution | Risk addressed | Ideal use | Limits | Evaluate | Cost drivers |
Role-based awareness training | Recognition and reporting | All staff; finance, HR and help desk first | Cannot catch every attempt | Role relevance, reporting tools, metrics beyond clicks | Seats, content depth |
Email and web filtering | Messages and sites reaching staff | Any organization using email | Misses novel or non-email attacks | Impersonation, QR and link handling, tuning effort | Mailboxes, add-ons, admin time |
IAM and phishing-resistant authentication | Credential theft, account takeover | Admins, finance, SaaS, remote access | Needs rollout and recovery design | FIDO support, recovery process, app coverage | Keys, licenses, migration |
Endpoint protection | Malware and remote tools | Every managed device | Does not stop voluntary approvals | Coverage, behavior detection, response actions | Endpoints, features |
Monitoring and response | Detecting and containing misuse | Teams with logs and people to act | Alerts need tuning and staff | Data sources, response times, handover | Data volume, retention, staffing |
Approval and verification procedures | Payment fraud, recovery abuse | Everyone | Works only if followed and audited | Clear owners, call-back rules, audits | Staff time, process design |
Scoped security assessments | Application weaknesses that widen stolen access | Organizations with web apps, APIs, SaaS | Does not train staff or stop deception | Scope, authorization, reporting, retest | Scope size, complexity |
Process often beats another tool. If payments can be changed by email alone, a better filter will not close the gap; a call-back rule will. A useful test is to ask what failed in your last near miss. If a person approved a payment because no one else needed to, buy nothing: change the rule. If staff cannot tell which messages to trust, invest in filtering and reporting. If a stolen login reached too much, fix identity and access first. Ask any vendor:
Which social engineering techniques does the product address, and which does it not?
How does it behave when a user is deceived?
What data does it collect, and where is it stored?
How are false positives and missed detections measured?
What does deployment require from our staff?
What are the main cost drivers and exit terms?
For small organizations, start with strong MFA on email and admin accounts, payment and recovery verification, a reporting channel and tested backups. Larger organizations add conditional access, least-privilege reviews, monitoring, response drills, supplier controls and application assessments. Teams using AI cybersecurity tools should apply the same questions.
When Does Penetration Testing Help?
Terms get mixed up, so separate them. Awareness training teaches people. Authorized phishing simulations measure how staff respond, with the caveats NCSC raises. Vulnerability scanning looks for known technical issues. Penetration testing is authorized testing of defined systems to find exploitable weaknesses. Red teaming emulates an adversary toward a goal across people, process and technology.
Scoped web application, API and SaaS testing helps when you want to know what an attacker could do after gaining a valid session. It may reveal weak authorization, tenant isolation gaps, session handling flaws or business-logic abuse that amplify account compromise. It is not the right tool when the problem is staff awareness, a missing approval workflow or mail filtering. Good scoping covers written permission, target systems, test windows, accounts and roles, deliverables and remediation re-testing. Related reading includes penetration testing, AI penetration testing and AI red teaming.
Timing matters. If you are commissioning custom web application development, plan an assessment before launch and after major changes. A useful scoping conversation answers these questions:
Which applications, APIs, environments and user roles are in scope, and which are excluded?
Who gives written authorization, and who is the emergency contact?
When can testing run, and which systems must not be touched?
What will the report contain, and how will fixes be re-checked?
How will test data and findings be stored and shared?
Articsledge arranges clearly scoped penetration testing services for web applications, APIs and SaaS platforms, plus vulnerability assessment and remediation verification as agreed. Specialist availability, methodology, personnel, deliverables, pricing and testing conditions are confirmed during scoping, and written authorization is required. It is an application security service, not employee training or a phishing simulation program, and no test guarantees total security. You can start a conversation through the contact page.
Emerging Social Engineering Threats and Trends
Voice and video impersonation. The Arup case shows how convincing synthetic media can be. IC3 recorded 22,364 complaints reporting AI-related information in 2025, with $893,346,472 in losses, though that figure does not say every case used synthetic media. See deepfake detection and AI fraud detection.
Mobile-first attacks. Verizon's 2026 release reports a 40% higher success rate for mobile-centric social engineering than traditional email phishing.
Collaboration and identity targets. Chat tools make more messages look internal, and fake sign-in pages that imitate an identity provider featured in the Twilio case. The same verification rules apply.
Fluent, localized messages. Language models can make well-written, multilingual text cheap, which weakens the old spelling-error clue. See AI-driven ransomware and AI security.
Manipulating AI assistants. Hidden instructions can steer AI tools, a risk covered in prompt injection and AI agent security.
Keep perspective: not every attack needs these technologies. Many still succeed with a simple text and a deadline.
The practical response is not panic. Treat voice and video like any other unverified channel, and keep verification rules independent of how real a call looks. Also review how your teams use generative AI tools and agentic AI, since those tools can be manipulated or can expose data. Your AI security governance should cover them.
Social Engineering Prevention Checklist
For individuals
Verify requests using contact details you find yourself.
Turn on passkeys or phishing-resistant MFA for email and banking.
Use a password manager and never share codes.
Open sites by typing the address, not through messages.
Report anything suspicious right away.
For organizations
Require call-back and dual approval for payment-detail changes.
Harden help-desk recovery with identity proofing.
Roll out phishing-resistant MFA to admins and finance first.
Apply least privilege and review it regularly.
Publish SPF, DKIM and DMARC and filter mail.
Add data loss prevention rules for sensitive exports.
Provide a no-blame report button and role-based awareness.
Log, monitor and rehearse incident response.
Check supplier and visitor processes.
Test critical applications within an agreed scope.
Frequently Asked Questions (FAQ)
What is social engineering?
Social engineering is the use of deception to make people disclose information, grant access, approve payments or perform harmful actions. It exploits trust, urgency and routine instead of a software flaw, and it can happen by email, text, phone, video or in person.
What are examples of social engineering?
Examples include a fake password-reset text, a caller posing as IT support, an invoice with changed bank details, a stranger following staff through a secure door and a deepfake video call requesting a transfer. Each persuades a person to act against their interest.
What are the most common types of social engineering attacks?
Phishing, spear phishing, smishing and vishing are widely reported, along with pretexting, business email compromise and tailgating. IC3 received 191,561 phishing and spoofing complaints in 2025. Newer forms include QR phishing, MFA fatigue and deepfake impersonation, and attackers often chain several together.
What is the difference between phishing and social engineering?
Social engineering is the broad category of manipulating people. Phishing is one form, using deceptive messages to obtain credentials or action. Other forms, such as tailgating, pretexting or phone-based impersonation, do not involve phishing messages at all, and some phishing carries malware.
Who is targeted by social engineering?
Anyone can be, but attackers favor finance staff, HR, executives, help desks, administrators and suppliers because they hold authority, money or access. Small organizations and individuals are targeted too, often through texts and phone calls, because they tend to have fewer checks in place.
Why do attackers create urgency?
Urgency reduces thinking time. A deadline or threat pushes people to act before verifying, which is why a request that demands immediate action, secrecy or skipping procedure deserves a pause and a check through a separate channel that you choose, not the sender.
Does multi-factor authentication stop social engineering?
MFA helps, but not equally. CISA treats FIDO/WebAuthn and PKI-based methods as phishing-resistant, while SMS, voice, one-time codes and push prompts can be phished or fatigued. Stronger methods reduce risk but do not stop payment fraud or fake calls.
What are the warning signs of social engineering?
Watch for urgency, secrecy, requests for codes or passwords, changed payment details, pressure to switch channels, mismatched sender addresses, unexpected MFA prompts and requests to bypass policy. Polished wording, real logos and a convincing email history are not proof of legitimacy.
Can deepfakes be used in social engineering?
Yes. Arup confirmed that fake voices and images were used in a 2024 fraud against its Hong Kong office. Because voice and face can be imitated, verify high-risk requests by calling a known number and require a second approver.
What should I do if I clicked a phishing link?
Tell your security team or IT immediately and stop using the device if advised. If you entered credentials, change them from a clean device and ask staff to revoke sessions. Do not wait to see whether anything happens.
How do I report social engineering?
Report internally first so security can act, then use your email provider's report function. If money moved, call your bank at once and report to your national fraud or cybercrime service, such as the FBI's IC3 in the United States.
How can I prevent social engineering attacks?
Verify requests through independent channels, use passkeys or phishing-resistant MFA, never share codes and open sites yourself. Organizations should add approval workflows, strict help-desk recovery, least privilege, filtering, monitoring and a practiced response plan, because no single control stops every attempt.
Does employee training prevent social engineering?
Training helps people recognize and report attempts, but NCSC says no training can teach users to spot every phishing attempt. Pair it with technical controls, verification workflows and a no-blame reporting culture, and measure reports as well as clicks.
When does penetration testing help against social engineering?
It helps limit damage by testing web applications, APIs and SaaS for weaknesses such as broken authorization or weak session handling that a stolen login could exploit. It does not train staff, replace verification procedures or stop a convincing phone call.
What is business email compromise?
Business email compromise uses fraudulent or hijacked email to trick staff into sending money or sensitive data, often by changing bank details. IC3 received 24,768 complaints and $3,046,598,558 in BEC losses in 2025. Call-back checks and dual approval are the key controls.
What is pretexting?
Pretexting is the use of an invented scenario, such as a fake auditor or supplier, to justify a request for information or access. The attacker builds credibility with plausible details, so confirm identity through a channel you control before sharing anything.
Key Takeaways
Social engineering targets human decisions, and phishing is only one of many forms.
Urgency, secrecy and requests to bypass process are more reliable warning signs than poor spelling.
Verify sensitive requests through an independently found channel before acting.
Phishing-resistant authentication, such as FIDO2 keys, stopped a real text-message phishing attack at Cloudflare.
Training and filtering each fail sometimes, so use layers and limit the damage of one deceived user.
Approval workflows and strict help-desk recovery often beat buying another tool.
Authorization, tenant isolation and session controls decide how far a stolen login can reach.
A scoped security assessment tests application controls, not staff awareness, and promises no total security.
Actionable Next Steps
Today: turn on phishing-resistant MFA or the strongest available MFA for email and admin accounts.
Today: add a call-back rule for any change to payment details.
This week: give staff a simple way to report suspicious messages without blame.
This week: review who can approve apps, reset accounts and grant admin rights.
This month: publish SPF, DKIM and DMARC and review email filtering.
This month: write a one-page response checklist and name an owner.
This quarter: apply least privilege, add step-up checks for sensitive actions and rehearse an incident.
This quarter: list your web applications, APIs and SaaS tools and decide which to assess.
Ongoing: review supplier processes and update training by role.
Glossary
Authentication: proving who you are to a system.
Authorization: deciding what an authenticated user may do.
Baiting: luring victims with something tempting, such as an infected USB drive.
Business email compromise (BEC): email fraud that tricks staff into payments or data transfers.
Deepfake: synthetic audio or video that imitates a real person.
DMARC: an email policy that builds on SPF and DKIM to check sender authenticity.
FIDO2/WebAuthn: standards for phishing-resistant sign-in with security keys or passkeys.
Least privilege: giving accounts only the access they need.
MFA fatigue: repeated prompts meant to wear down a user until they approve.
OAuth consent phishing: tricking a user into granting an app access to their data.
Passkey: a password replacement based on public-key cryptography.
Penetration testing: authorized testing of defined systems to find exploitable weaknesses.
Phishing: deceptive messages designed to steal credentials or prompt harmful actions.
Pretexting: using an invented scenario to justify a request.
Quishing: phishing through QR codes.
Smishing: phishing by text message.
Tailgating: following an authorized person into a restricted area.
Vishing: phishing by voice call.
Sources & References
FBI Internet Crime Complaint Center. 2025 Internet Crime Report. Publication date not stated. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
Verizon. Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds. 19 May 2026. https://www.verizon.com/about/news/breach%2Dindustry%2Dwide%2Ddbir%2Dfinds
NIST. Computer Security Resource Center glossary: Social engineering. Date not stated. https://csrc.nist.gov/glossary/term/social_engineering
MITRE. ATT&CK T1684 Social Engineering. Last modified 12 May 2026. https://attack.mitre.org/techniques/T1684/
MITRE. ATT&CK T1566 Phishing. Last modified 18 September 2026. https://attack.mitre.org/techniques/T1566/
UK National Cyber Security Centre. Phishing attacks: defending your organisation. Published 5 February 2018, last reviewed 13 February 2024. https://www.ncsc.gov.uk/guidance/phishing
CISA. Implementing Phishing-Resistant MFA. October 2022. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
NIST. Cybersecurity Framework (CSF 2.0). Page date not stated. https://www.nist.gov/cyberframework
Twilio. Incident report on the August 2022 social engineering attack. Published 7 August 2022, updated through 27 October 2022. https://www.twilio.com/en-us/blog/august-2022-social-engineering-attack
Cloudflare. The mechanics of a sophisticated phishing scam and how we stopped it. 9 August 2022. https://blog.cloudflare.com/2022-07-sms-phishing-attacks/
MGM Resorts International. Form 8-K. 5 October 2023. https://www.sec.gov/Archives/edgar/data/789570/000119312523251667/d461062d8k.htm
Fortune. Report on the Arup deepfake fraud in Hong Kong. 17 May 2024. https://fortune.com/europe/2024/05/17/arup-deepfake-fraud-scam-victim-hong-kong-25-million-cfo/
OWASP. API Security Top 10, 2023 edition. 2023. https://owasp.org/API-Security/editions/2023/en/0x11-t10/
IETF. RFC 7208: Sender Policy Framework (SPF). April 2014. https://www.rfc-editor.org/rfc/rfc7208
IETF. RFC 6376: DomainKeys Identified Mail (DKIM) Signatures. September 2011. https://www.rfc-editor.org/rfc/rfc6376
IETF. RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC). March 2015. https://www.rfc-editor.org/rfc/rfc7489
