Social engineering

What it is

Rather than hacking a firewall first, the attacker hacks human trust. They pose as helpdesk staff, a vendor, a romantic interest, or authority. Urgency, fear, greed, and helpfulness are the usual levers.

Phishing, vishing, smishing, pig butchering, and many tech-support scams are all forms of social engineering.

How it works

1. Research — Public profiles, breach data, or company org charts supply details.
2. Pretext — A believable story positions the attacker as someone you should trust.
3. Engage — Email, call, text, or in-person contact builds compliance.
4. Exploit — You share a password, approve a login, wire money, or plug in a USB.
5. Escalate — Access is used for deeper fraud or sold.
6. AI impersonation simply modernizes the same playbook with better costumes.

Red flags

• Requests that bypass normal procedure just this once
• Authority plus urgency (CEO needs this wire before close of business)
• Unsolicited help (I'm from IT — install this remote tool)
• Secrets and isolation (Do not tell the finance team yet)
• Too-good offers that require upfront payment or personal data
• Small asks that grow into larger ones once trust is gained

What to do if you’re targeted

• **Slow down.** Verify using a channel you initiate — known phone numbers, official apps, in-person checks.
• **Use dual control** for money movement at work and a family code word at home.
• **Do not share OTP codes** or install remote-access software for unexpected contacts.
• **If you complied:** change credentials, call your bank, and document what happened.
• **Report** to your security team (if work) and ReportFraud.ftc.gov (U.S.) when appropriate.
• **Optional education check-in:** free identity scan if personal data was exposed during the interaction.

Related terms

• Phishing
• Vishing
• Pig butchering