Social engineering
Hacking people instead of computers. The psychological levers attackers pull, from pretexting and baiting to tailgating, and how to build habits that resist them.
Why attackers target people
Breaking strong encryption is hard. Convincing a busy person to reset a password, open a door or approve a payment is often easy. Social engineering is the umbrella term for manipulating people into doing something that helps an attacker. Phishing is the best-known form, but the same psychology shows up on the phone, in person and on social media.
The six levers
Researchers of persuasion describe a handful of principles that make people say yes. Attackers use them deliberately:
| Lever | What it sounds like |
|---|---|
| Authority | "This is the CEO", "I'm calling from IT", "This is the police" |
| Urgency and scarcity | "The wire must go out before 3 pm", "Only today" |
| Fear | "Your account has been hacked", "You will be arrested" |
| Helpfulness and liking | A friendly caller who chats about your weekend before asking a favor |
| Social proof | "Everyone in your team already completed this form" |
| Reciprocity | A small gift or favor first, followed by a request |
If a message pushes two or three of these at once, slow down.
Common techniques
- Pretexting: inventing a believable story, such as a new employee locked out, an auditor or a vendor, to justify an unusual request.
- Help desk impersonation: calling an IT help desk while pretending to be an employee and asking for a password reset or a new two-factor device. This technique has been central to several major corporate breaches.
- MFA fatigue: sending repeated push approval requests until a tired user taps "Approve". Number matching in authenticator apps was introduced to stop this.
- Baiting: leaving infected USB drives labelled "Salaries 2026" in a parking lot, or offering free downloads that hide malware.
- Tailgating and piggybacking: following an employee through a secure door, often carrying boxes so someone holds it open.
- Quid pro quo: offering "free tech support" in exchange for remote access.
- Watering hole: compromising a website that a target group visits often.
- Profile research: using public social media posts (pets' names, birthdays, job changes) to craft convincing messages or guess security answers.
Defenses for individuals
- Verify through a second channel. If a request arrives by email, confirm by phone using a number you already know, or in person.
- Treat unsolicited contact with suspicion, especially if it asks for codes, passwords, payments or remote access.
- Share less publicly. Hide your birthday, phone number and family details on social profiles, and use fake answers to security questions (store them in your password manager).
- Never approve a sign-in prompt you did not start. Deny it and change your password.
- Never plug in a found USB drive. Hand it to IT or throw it away.
Defenses for organizations
- Require call-back verification for any change of bank details or payroll information.
- Give the help desk a strict identity-check process for password and MFA resets, including video or manager confirmation for privileged accounts.
- Use phishing-resistant MFA (passkeys or security keys) for admins.
- Run regular, friendly awareness training and praise people who report suspicious contact.
- Make it culturally normal to say "I need to verify this first", even to senior leaders.
A good test for any unusual request: "If this person is genuine, would they mind if I checked?" Real colleagues and companies never object to verification. Criminals always do.
