What is social engineering and how can you avoid it?

Social engineering is a technique attackers use to manipulate you into giving up information, access, or money. Often termed “hacking the human,” instead of cracking your passwords, attackers crack you – playing on trust and urgency to get what they want. 

Anyone who checks their email or takes phone calls can encounter this. Find out how to recognize what social engineering looks like and spot the warning signs. I’ll also explain how you can take steps to protect yourself and the people around you.

The short answer: what to do right now

Social engineering works because it targets emotion, not technology. Your best defense is a handful of habits that slow you down just enough to think before you act.

Quick-action checklist:

1. Pause when pressured: Urgency is the biggest weapon in a scammer’s arsenal. If someone says “act now or lose access”, that’s your cue to stop and verify.
2. Verify independently: Got a call supposedly from your bank? Hang up and dial the number on the back of your card. Received an email that appears to be from your boss? Message them through a separate channel you already trust.
3. Never share codes or passwords: No legitimate organization such as your bank or IT support will ever ask for your password or a one-time verification code.
4. Enable multi-factor authentication (MFA): Even if someone tricks you out of a password, MFA stops them from logging in without that second factor.

Warning: Social engineering attacks are increasingly sophisticated. AI tools now allow scammers to remove spelling errors that used to be giveaways, clone voices from just minutes of audio, and generate personalized messages using leaked data.

What is social engineering?

A significant portion of cyberattacks don’t exploit software vulnerabilities first. They target humans instead.

The goal might be stealing login credentials, convincing you to wire money, installing malware, or simply getting you to reveal one small piece of information that unlocks a larger attack.

What makes social engineering so effective is that it doesn’t require the attacker to be technically skilled. Just one persuasive email or phone call can do what hours of hacking can’t.

The psychology behind it

These attacks work because they play on how our brains naturally respond:

• Authority bias – We tend to comply with requests from people who appear to be in charge. A “manager” or “government official”, for example.
• Urgency and scarcity – When we feel time is running out, we stop thinking critically. “Your account will be suspended in 24 hours” is intended to trigger panic rather than careful thought. 
• Reciprocity – If someone does you a small favor, you feel compelled to return it. Attackers use this to build rapport before asking for something bigger.
• Curiosity gaps – Sensationalist messages like “You won’t believe what just happened” are almost irresistible to click.

Understanding these triggers is half the battle. Once you can put a name to what’s happening, social engineering loses much of its power.

Common types of social engineering attacks

Social engineering takes many shapes. The following are the most prevalent tactics you’re likely to encounter:

Phishing

Phishing is the most common form of social engineering. You receive an email (or text – sometimes called “smishing“) that appears to come from a trusted source: your bank, a delivery service, or a colleague.

The message typically asks you to click a link or download an attachment. The link usually leads to a fake login page that captures whatever you type and sends it straight to the attacker. The page may look identical to the real thing – the same layout, logo, and fonts.

Spear phishing

While regular phishing casts a wide net, spear phishing is more targeted. The attacker does their homework, perhaps using information scraped from social media or data breaches. This allows them to craft a message that feels personally relevant. It might reference a project you’re working on or your manager’s name, for example.

Spear phishing attacks are far more convincing, which makes them significantly harder to detect.

Pretexting

In a pretexting attack, the scammer creates a fabricated scenario – a pretext – to justify their request. They might pose as an external auditor, a vendor needing to update payment details, or an IT support technician who “needs your login to fix a server issue.”

The sophistication of pretexting varies. Some are elaborate and involve multiple calls and emails over days or weeks. Others are a single phone call. Regardless, they share a narrative designed to make the request feel reasonable.

Baiting

Baiting dangles something tempting: a USB drive labeled “Payroll” or an email announcing you’ve won a prize. When curiosity wins, the bait delivers malware.

Quizzes and trivia scams

Personality quizzes that ask for your pet’s name or first school are often the same questions used as security answers for password recovery. Social engineers gather these puzzle pieces over time to build a profile that helps them bypass security questions or impersonate you.

Vishing and deepfake voice scams

Voice phishing – or “vishing” – involves fraudulent phone calls. A caller may claim to be from your bank’s fraud department or tech support. Increasingly, attackers use AI to clone the voice of someone you know, such as an executive at your company or even a family member in distress. This makes the call sound authentic as well as emotionally urgent.

SIM swapping

In a SIM swap attack, the scammer convinces your mobile carrier to transfer your phone number to their SIM card. Once they control your number, they can intercept SMS-based two-factor authentication codes and reset passwords for accounts tied to your phone.

This works through social engineering against carrier support staff. The attacker pretends to be you, claiming a lost or damaged phone, and pushes to port your number.

BEC (Business Email Compromise)

BEC is one of the costliest forms of social engineering, targeting businesses and individuals with high net worth. Attackers research executives, finance staff, or vendors, then compromise or spoof email accounts to send seemingly legitimate requests for wire transfers or sensitive data changes.

For example, an employee receives an email from what looks like their CEO, asking for an urgent payment to a “new vendor”. The email address might be nearly identical to the real one. The victim wires money, only to discover later the request was fraudulent.

How to protect yourself (and the people around you)

The good news is you don’t need to be a security expert to defend yourself. A few consistent habits go a long way.

Build verification habits

The single most effective defense is learning to pause and verify before acting on any unexpected request – especially those that carry urgent requests such as for money or credentials.

• Use a known, trusted contact method: If a caller claims to be from your bank, hang up and call the number printed on your card or statement. If an email supposedly comes from a colleague, reach them via a different channel you already use.
• Check URLs carefully: Look for subtle misspellings in web addresses. “paypa1.com” instead of “paypal.com”, or “arnazon.com” instead of “amazon.com”. When in doubt, navigate to the site manually rather than clicking on a link.
• Slow down: Legitimate organizations don’t mind if you take a few minutes to verify. Scammers depend on rushed decision-making.

Strengthen your online defenses

These steps keep things manageable if you ever fall for a scam:

• Use a password manager to generate and store unique passwords for every account. If one password leaks, the rest stay safe. Consider a trusted option like Proton Pass.
  
• Enable MFA everywhere it’s offered – preferably using an authenticator app or hardware key rather than SMS, which can be intercepted via SIM-swap attacks.
• Keep software updated. Updates patch vulnerabilities that attackers actively exploit. This applies to your operating system, browser, and apps.
• Limit what you share publicly. Review your social media privacy settings. Think twice before posting details that could serve as security answers or help an attacker impersonate you.

Talk to the people around you

Social engineering doesn’t just target individuals. Share what you learn with older relatives, friends who aren’t particularly tech-savvy, and coworkers. In the workplace, organizations should run regular awareness training and foster a culture where employees feel comfortable questioning suspicious requests even from senior staff.

When things go wrong

If you suspect you’ve been targeted or fallen for a social engineering attack, act quickly. Acting within hours – not days – can limit the damage considerably. Many financial institutions can freeze transactions or reverse transfers if contacted promptly.

• Change passwords for any accounts that may have been compromised, starting with email and banking.
• Contact your bank if any financial information was shared.
• Monitor accounts for unusual activity over the following weeks.
• Report it. In the US, file a report with the FTC. In the UK, contact Action Fraud.

What it all comes down to

Social engineering succeeds by making us react before we think. The good news is that the countermeasure is simple: slow down, verify, and treat any unexpected request for money, credentials, or access with healthy skepticism.

Social engineering: FAQs