What is social engineering? A plain-English guide
Social engineering is the art of manipulating people, not machines, to hand over access, money, or data. Here is how it works and how to stop it.
Social engineering means tricking a person into taking an action that benefits an attacker, such as clicking a malicious link, wiring money, or revealing a password. It exploits human psychology rather than software flaws. Most data breaches involve a human element, and CISA classes social engineering as a primary attack vector across both public and private sectors.
How is social engineering different from hacking?
Traditional hacking targets software or hardware vulnerabilities. Social engineering targets the person sitting at the keyboard. Attackers often prefer it because no CVE number (a public identifier for a software flaw) is needed and patching a human is harder than patching an app.
The two approaches also combine regularly. An attacker might use a phishing email (a fake message designed to steal credentials) to plant malware, then use that malware to move deeper into a network. NIST defines social engineering as "an attempt to trick someone into revealing information or taking an action that can be used to attack systems or networks."
What are the main types of social engineering attack?
Phishing is the most common form: a deceptive email, text, or voice call that impersonates a trusted sender. Spear phishing narrows the target to one specific person or organisation, using personal details to sound convincing. Pretexting builds a fictional scenario (say, posing as IT support) to extract information. Baiting leaves physical or digital lures, like an infected USB drive, for a curious victim to pick up.
| Attack type | Primary channel | Goal |
|---|---|---|
| Phishing | Email, SMS, voice | Steal credentials or install malware |
| Spear phishing | Targeted email | Account takeover or wire fraud |
| Pretexting | Phone or in person | Extract sensitive data via false identity |
| Baiting | Physical media or download links | Deliver malware |
| Quid pro quo | Phone or chat | Trade fake help for access |
| Tailgating | Physical premises | Gain unauthorised building entry |
Why do people fall for it?
Attackers exploit well-documented psychological biases: urgency ("your account will be locked in one hour"), authority ("this is your CEO"), and social proof ("everyone on your team has already confirmed"). NIST SP 800-63B notes that credential theft through deception remains a leading cause of account compromise precisely because these triggers bypass careful thinking.
Fear and time pressure are the two levers pulled most often. When a message feels urgent, people skip the verification step they would normally take.
What real-world damage does social engineering cause?
Business email compromise (BEC), a scam where an attacker impersonates an executive to redirect payments, cost victims more than 50 billion USD globally between 2013 and 2023 according to FBI IC3 data. Many of those losses started with a single phishing email or a phone call to a finance employee.
Social engineering also underpins most ransomware delivery. An employee clicks an attachment, credentials are stolen, and the attacker moves laterally before encrypting files. CISA's #StopRansomware advisories consistently list phishing as the initial access method.
How can individuals and organisations defend against social engineering?
Verification before action is the single most effective habit. Call back on a number you already know, not one given in the suspicious message. Slow down when a request carries artificial urgency.
Organisationally, four controls make the biggest difference:
- Multi-factor authentication (MFA), meaning a second proof of identity beyond a password, blocks credential-based attacks even after a phishing attempt succeeds. CISA recommends MFA as a top control.
- Security awareness training teaches employees to recognise pretexting and phishing cues before they act.
- Strict payment-change procedures (call-back verification on any new bank details) cut BEC losses.
- Simulated phishing exercises, run regularly, measure whether training is working and which staff need extra support.
Technical controls help too. Email authentication standards like DMARC, DKIM, and SPF (three protocols that verify a sender's domain is legitimate) reduce spoofed-sender emails reaching inboxes. CISA's DMARC guidance explains deployment steps for federal and private-sector organisations.
How does social engineering relate to specific CVEs and software patches?
Social engineering itself has no CVE number because it is not a software defect. It is a technique. That said, attackers frequently pair it with patched vulnerabilities: a phishing email delivers an exploit for a known flaw, counting on the victim not having applied the update. Keeping software current removes one tool from the attacker's kit, even when the initial entry point is human.
Common questions
Is phishing the same as social engineering?
Phishing is one type of social engineering, the most common one. Social engineering is the broader category covering any manipulation of people, whether by email, phone, in person, or via physical objects.
Can multi-factor authentication stop social engineering?
MFA blocks many credential-theft attacks but not all. Real-time phishing proxies and MFA fatigue attacks (bombarding a user with push notifications until they approve one) can bypass it, which is why CISA recommends phishing-resistant MFA such as hardware security keys or passkeys over simple push-approval apps.
