What Is Social Engineering?

What Is Social Engineering?

Social engineering is a category of attack that targets human psychology rather than technical vulnerabilities. Instead of exploiting software flaws, attackers exploit trust, fear, urgency, and authority to manipulate individuals into handing over credentials, granting access, or transferring money.

Why It Works

Humans are wired to be helpful, to respond to authority, and to act quickly under pressure. Attackers study these tendencies and craft scenarios that trigger them. A well-executed social engineering attack can bypass firewalls, antivirus software, and multi-factor authentication in minutes.

Common Techniques

Pretexting involves creating a fabricated scenario to extract information. An attacker might pose as an IT technician needing your password to fix an urgent issue.

Phishing uses deceptive emails or messages that appear to come from trusted sources, directing victims to fake login pages or malicious downloads.

Vishing (voice phishing) uses phone calls, often with spoofed caller IDs, to impersonate banks, government agencies, or internal IT departments.

Baiting leaves infected USB drives in car parks or reception areas, counting on curiosity to do the rest.

The Digital–Physical Connection

Social engineering does not stay in the digital world. A convincing phone call can unlock a building. A fake delivery uniform can bypass a reception desk. Understanding how these attacks cross the physical–digital boundary is essential for any organisation.

How to Protect Yourself

Verify identities through official channels before acting on any request. Slow down when you feel pressured to act urgently. Report suspicious interactions to your security team immediately.