What Is Social Engineering

Social engineering is the umbrella term for attack techniques that obtain confidential information, or induce unauthorized actions, by exploiting human psychological weaknesses rather than technical means.

However advanced the security system in place, it counts for nothing once the person operating it is deceived. In the security field it is often said that the weakest link is the human being. In the Data Breach Investigations Report (DBIR) that Verizon publishes every year, the human element (social engineering, stolen credentials, and similar factors) was involved in just over 60 percent of confirmed breaches (2024 and 2026 editions). No matter how far the technical defenses are hardened, the route that runs through people remains open.

Phishing is a representative form of social engineering, but the methods are not limited to email. Phone calls, face-to-face contact, social media, and physical approaches are all used in attacks.

Common Tactics

Pretexting: Impersonating IT support, a bank employee, or a police officer and using a plausible pretext to extract passwords or personal information. Common pretexts include "for a security verification" or "to recover from a system outage."
Baiting: Leaving a USB drive loaded with malware in a parking lot or an office and waiting for whoever picks it up to plug it into a computer. Labels such as "Salary list" or "Personnel changes" are used to arouse curiosity.
Tailgating: A physical technique in which the attacker follows a legitimate employee into an office that requires a security card, often by standing behind someone with their hands full and asking, "Could you hold the door?"
Vishing (voice phishing): Impersonating a card issuer or a bank over the phone and creating urgency with a claim such as "we have detected fraudulent use" in order to obtain a card number or PIN. Caller ID can be spoofed, so a legitimate number shown on the screen is no basis for trusting who is calling.
Reconnaissance through social media: Collecting the target's employer, job title, hobbies, and personal relationships from social media posts in order to make spear phishing more convincing.

Psychological Techniques Exploited by Attackers

Social engineering makes skillful use of human cognitive biases and psychological tendencies.

Deference to authority: When an attacker poses as an authority such as a manager, the IT department, or the police, people tend to comply without questioning. Business email compromise (BEC) that imitates "an urgent instruction from the CEO" exploits exactly this reflex.
Manufactured urgency: Lines such as "your account will be suspended unless you act now" or "please confirm within 24 hours" push the target into acting before there is time to think.
Reciprocity: By doing a favor first, the attacker creates the feeling that it has to be returned, as in "I fixed the trouble you had the other day, so could you tell me your password for confirmation?"
Social proof: Saying "everyone else on the team has already taken care of this" exploits the sense that one ought to follow suit.
Liking and trust: Spending a long period building a relationship before drawing out information. Some cases involve approaching the target on social media while posing as a friend.

Defense Strategies for Organizations and Individuals

Defending against social engineering requires both technical and human measures.

Measures for organizations

Security awareness training: Run simulated phishing exercises on a regular basis, then measure and improve how employees respond. A classroom session once a year is not enough.
Information classification and least privilege: Restrict access to confidential information to the smallest number of people who need it for their work.
An established identity verification process: Make it a firm rule that when a password reset or a payment is requested by phone or email, the requester is verified through a separate channel.
Moving to phishing-resistant authentication: Two-factor authentication is a barrier when a password leaks, but schemes in which the user types a one-time password can be relayed and defeated by adversary-in-the-middle (AiTM) phishing. With passkeys (FIDO2), the key is bound to the domain of the legitimate site, so no valid signature can be produced on a fake domain and this route is closed off.

Measures for individuals

Handle unexpected contact carefully. Even when you are being rushed, stop once and think.
Review how widely you publish personal information on social media. Your employer, job title, and daily patterns all become material for an attack.
If something feels wrong, look up the contact details yourself and call back. Do not dial the number the other party gave you.

Common Misconceptions

Social engineering only fools people who are not tech-savvy: Even security experts can be deceived. Attackers target human psychological weaknesses (urgency, authority, goodwill) rather than technical knowledge, so high IT literacy alone is not a defense.
Social engineering is only an email problem: Phone calls, in-person interactions, social media, and physical methods (leaving USB drives, impersonating visitors) are all used as attack vectors. Email filtering alone is an insufficient countermeasure.

Social Engineering