When people think about a cyberattack, they often picture malware, exploited vulnerabilities, or someone breaking through a firewall. In many real incidents, however, the first move is much less spectacular: an email that looks credible, a phone call that sounds urgent, a Teams message from someone who appears to be a colleague, or a request that arrives at exactly the wrong moment.
Social engineering is the use of deception to convince a person to do something that helps an attacker: share credentials, approve a payment, open a malicious file, reset an account, disclose confidential information, or bypass a control. It is sometimes called human hacking, but that expression can be misleading. People are not simply the “weakest link”. They are making decisions under pressure, with incomplete information, inside processes that often reward speed more than verification.
In this article, we look at how social engineering works, which techniques are most common, and what organizations can do to reduce the risk without turning every business interaction into a security bottleneck.
Social engineering works because it does not start by attacking technology. It starts by attacking attention. A good pretext makes a request feel normal, urgent, familiar, or harmless. The victim is not always careless. Often, they are simply busy, trying to be helpful, or responding to what looks like a legitimate business need.
Attackers know which buttons to press. Authority is one of the strongest: a message that appears to come from a CEO, a CFO or an IT administrator tends to receive less scrutiny. Urgency is another classic lever, because people make worse security decisions when they believe there is no time to stop and verify. Familiarity also matters. If the attacker knows the name of a supplier, the wording used by an internal team, or the timing of a real project, the request immediately feels more believable.
A targeted social engineering attack rarely begins with the malicious message itself. It usually starts earlier, with reconnaissance. Public sources such as LinkedIn, company websites, press releases, job ads and previous data leaks can reveal names, roles, reporting lines, technologies, suppliers and internal language. For an attacker, that information is enough to turn a generic scam into something that looks like business as usual.
Once the attacker has enough context, they build a pretext: a fake identity, a plausible problem, a routine request, or a confidential business scenario. Then comes the moment of pressure. The victim is asked to click, approve, transfer, reset, share, or make an exception. If the action succeeds, the attacker tries to leave the interaction looking ordinary, so the victim does not report it immediately.
Social engineering is not limited to email. It follows the way people actually work: inboxes, phones, SMS, collaboration platforms, social media, QR codes and even physical offices. The channel changes, but the goal remains the same: make the wrong request feel trustworthy.
Phishing is still one of the most common entry points because it is cheap, scalable and easy to adapt. In its simplest form, it is broad and opportunistic: the attacker sends many messages and waits for someone to respond. Spear phishing is more selective and more dangerous, because the message is tailored to a specific person, role or organization. Whaling targets executives and senior decision-makers, where a single compromised account or approved request can have a much wider impact.
Vishing moves the attack to the phone, where tone, confidence and real-time pressure can make the deception more convincing. Smishing uses SMS or messaging apps, taking advantage of the fact that people often react quickly on mobile devices and inspect links less carefully. Quishing hides the malicious destination behind a QR code, which is particularly problematic because the user cannot read the final URL before scanning it.
Business Email Compromise, or BEC, is one of the clearest examples of how profitable persuasion can be. Attackers impersonate executives, suppliers or trusted partners to redirect payments, request sensitive files or trigger fraudulent approvals. The FBI IC3 2024 Annual Report recorded close to $2.8 billion in BEC-related losses, which shows why this technique remains so attractive to criminal groups. Other techniques include pretexting, where the attacker invents a believable scenario to extract information, baiting, where curiosity becomes the hook, and tailgating, where someone physically follows an authorized employee into a restricted area.
Artificial intelligence has not invented social engineering, but it has made it easier to scale and harder to recognize. The old warning signs, such as awkward grammar, strange phrasing or obviously generic messages, are less reliable when attackers can generate polished, localized and context-aware text in seconds.
Deepfakes raise the stakes even further. Voice and video can no longer be treated as proof of identity on their own, especially when money, privileged access or sensitive information are involved. The lesson is not that every call should be considered fake. The lesson is that high-value actions need independent verification through a trusted channel.
There is no single product that “solves” social engineering. The most effective defense is a combination of technical controls, clear processes and a culture where verification is treated as normal, not as a sign of distrust. This is one of the few sections where a concise list is useful, because the controls need to be concrete.
Social engineering remains dangerous because it targets the moment in which someone has to decide whether to trust a request. Technology can reduce the attack surface, but it cannot replace human judgment. That is why cybersecurity must also train the right behaviors: knowing when to pause, how to verify, when to escalate and why a suspicious request should never be handled in isolation.
A mature organization is not one where employees are suspicious of everything. It is one where people are trained, through the right security awareness program, to recognize pressure tactics and respond in a consistent way. If a request is urgent, unusual, confidential or financially sensitive, checking it should be part of the workflow. That short pause, learned and reinforced over time, is often what separates a routine business task from a breach.