What is a social engineering attack?

CISA, the US cyber security agency, describes social engineering as using human interaction and social skills to obtain or compromise information about an organisation or its computer systems. It works because people are helpful, busy and trusting, and it is often far easier to trick someone into handing over a password than to break the encryption protecting it.

How common are social engineering attacks?

Very. Verizon's 2025 Data Breach Investigations Report, which analysed over 12,000 confirmed breaches, found that the human element, such as falling for a scam, making an error or misusing access, was involved in about 60% of them. In its 2025 Internet Crime Report, the FBI recorded about $3.05 billion in US losses from business email compromise alone, a scam that is pure social engineering.

Social engineering attacks rely on which of the following?

This is a common quiz question, and the answer is human psychology: trust, fear, urgency, curiosity, greed and the wish to be helpful, rather than weaknesses in software. Attackers use the same few pressures again and again.

Social engineering vs phishing

Phishing is one kind of social engineering, and the most common. Social engineering is the wider idea: any attack that works by manipulating people. It includes phishing messages, but also phone calls, in-person visits, fake job offers and long, patient relationships built online before the request comes.

Types of social engineering attacks

Phishing

Fake emails or messages that pretend to come from a trusted source, asking you to click a link, open an attachment or log in to a fake site. Sent in bulk, they rely on a few people taking the bait.

Spear phishing, whaling and business email compromise

Phishing aimed at one person or organisation, using researched details to look real. Whaling targets senior executives, and business email compromise poses as a boss or supplier to redirect payments. Our guide to spear phishing covers these in detail.

Smishing and vishing

Smishing is phishing by text message, such as a fake parcel delivery fee. Vishing is voice phishing by phone: a caller claiming to be from your bank's fraud team, tech support or a government office. Some criminals now use AI to clone the voice of someone you know.

Pretexting

The attacker invents a believable story, the pretext, to justify asking for information: a new contractor who needs building access, an auditor checking accounts, or an IT technician fixing a problem. Good pretexts use real names and details found online.

Baiting

Leaving something tempting for the victim to pick up, like an infected USB stick, or offering a free download that carries malware. Curiosity does the rest.

Quid pro quo

Offering something in return: "I'm from IT. I can speed up your laptop if you install this tool." The tool gives the attacker remote access.

Tailgating and other physical tricks

Tailgating (or piggybacking) means following an authorised person through a secure door. Other physical tricks include posing as a delivery driver or cleaner, reading passwords over someone's shoulder, and searching bins for documents.

Scareware and fake support

A pop-up claims your computer is infected and gives a number to call or software to buy. The "support" agent then takes control of the computer or takes payment for nothing.

A real example: the 2020 Twitter hack

In July 2020, hackers took over 130 Twitter accounts, including those of famous people, and used them to promote a bitcoin scam. New York's Department of Financial Services investigated and found no malware, no exploits and no backdoors. Instead, the attackers phoned Twitter employees pretending to be from the IT help desk, said they were fixing VPN problems, and directed them to a fake login page. That was enough to get into Twitter's internal tools. The scam collected about $118,000 in bitcoin.

It is a textbook case: authority (the help desk), a believable pretext (VPN trouble during the shift to home working) and a fake website, with no technical hacking needed.

The stages of a social engineering attack

1. Research: the attacker gathers names, job roles, suppliers and habits from websites and social media.
2. Hook: they make contact with a story built on that research.
3. Play: they build trust or pressure and get what they came for: a password, a payment, access.
4. Exit: they leave without raising suspicion, often covering their tracks.

Try choosing the safe response to a scam call or message, then press Mark to check it in our Social Engineering course.

How to protect yourself from social engineering

1. Slow down. Urgency is the attacker's main tool. A real bank, boss or IT team can wait five minutes while you check.
2. Verify through a second channel. Call back on a number you already have, not one from the message, or ask the person face to face.
3. Never share passwords or one-time codes. No genuine IT team, bank or company needs them.
4. Check before you click. Hover over links, look closely at sender addresses, and go to websites by typing the address yourself.
5. Use multi-factor authentication, ideally passkeys or security keys, which don't work on fake sites.
6. Don't plug in unknown USB sticks or install software someone offers out of the blue.
7. Challenge politely. It's fine to ask a stranger in the office who they are visiting, and not to hold the door.
8. Report it, even if you only suspect it, or if you've already clicked.

What organisations can do

• Training and practice so staff recognise the pressures and know what to do. The UK NCSC advises several layers of defence, because training alone won't stop every attack.
• Clear procedures for sensitive requests, such as call-back checks and two-person approval for payments and password resets.
• Technical layers: email filtering and authentication (SPF, DKIM, DMARC), phishing-resistant MFA and least-privilege access, so one fooled employee can't open everything.
• A no-blame reporting culture, so people speak up fast when they make a mistake.

What to do if you think you have been targeted

1. Stop replying and don't click anything else in the message.
2. Report it to your IT or security team at work, or to the organisation the attacker pretended to be.
3. If you shared a password, change it at once, and anywhere else you used it, then check that multi-factor authentication is on.
4. If you sent money or bank details, call your bank immediately using the number on your card. The faster you act, the better the chance of stopping a payment.
5. Warn others, such as colleagues or family, because attackers often try the same trick on several people.

Why social engineering works so well

Security systems are built to stop unknown people. Social engineering makes the attacker look like a known person, or gets a known person to act for them. It also uses habits that are normally good: answering colleagues quickly, helping customers, obeying managers. And it is getting easier, because AI can write fluent, personal messages in any language and imitate voices, which removes old giveaways like poor spelling. The defence that still works is the habit of checking unusual requests through a channel the attacker doesn't control.

Common mistakes

• Thinking only careless people fall for it. Good attacks fool experts, because they are tailored and well timed.
• Trusting caller ID or a familiar name. Both can be faked.
• Assuming security is IT's job. Social engineering goes straight past technical defences to people.
• Feeling too embarrassed to report. Fast reporting is what limits the damage.
• Thinking it only happens by email. Phone calls, texts, social media, QR codes and in-person visits are all used.

Read next

Computer Science · CoursesSocial engineering course: spot and stop scamsA social engineering course in 24 short sections: why scams work, phishing, lookalike links, scam calls, deepfakes, and how to defend and report.