What Is Social Engineering? Types, Examples and Defenses

Social engineering is the manipulation of people, rather than software, to get them to give up information, grant access or move money. An attacker poses as someone trusted, such as an executive, the IT help desk or a vendor, and uses pressure like authority, urgency or curiosity to push one harmful action: clicking a link, sharing a code, resetting an account, paying an invoice or plugging in a device. Common forms include phishing, vishing, smishing, pretexting, baiting, tailgating, BEC and deepfakes. The defense is layered: phishing-resistant MFA, out-of-band verification, easy reporting and regular testing.

Key takeaways

• Social engineering targets processes as much as people: a password reset, a payment change or a door that opens for anyone carrying boxes.
• It is common. The 2026 Verizon Data Breach Investigations Report found a non-malicious human element in 62% of breaches and ranked social engineering as the third most common breach pattern.
• Nearly every attack pulls the same few psychological levers, so the warning signs are predictable even when the channel is new.
• Deepfake voice and video have made "I recognized their voice" an unreliable check. Verification has to happen through a channel the attacker does not control.
• Testing measures how well your people, processes and controls hold up, so you can fix the process instead of blaming the person.

What Is Social Engineering?

NIST defines social engineering as "an attempt to trick someone into revealing information (e.g., a password) that can be used to attack systems or networks" (NIST CSRC glossary). Another NIST definition in the same glossary is broader: deceiving an individual into revealing sensitive information, obtaining unauthorized access or committing fraud by gaining their confidence and trust. That second definition fits what organizations face today. The goal is not always a password. It is often a wire transfer, an approved MFA prompt or a help desk agent who resets the wrong person's account.

Social engineering is sometimes called "human hacking" because it works around technical controls instead of breaking them. A firewall cannot stop an employee who has been convinced that a request is legitimate. That is also why the problem persists. The 2026 Verizon Data Breach Investigations Report (DBIR) found a non-malicious human element in 62% of breaches, up from 60% the year before. It named social engineering the third most common breach pattern, at 16% of breaches, and noted it has been one of the most common breach types since 2018.

The FBI sees the same pattern in fraud reports. In its 2025 Internet Crime Report, phishing and spoofing was again the most reported complaint type, with 191,561 complaints, and business email compromise caused about $3.05 billion in reported losses. For trend data and breakdowns, see our roundups of social engineering attack statistics, phishing statistics, vishing statistics and smishing statistics. This guide covers how the attacks work and how to stop them.

How a Social Engineering Attack Works

Most social engineering attacks follow four stages. Knowing them helps because each stage has a control that can break the chain.

1. Research. The attacker collects public details: org charts, job postings, social media profiles, vendor relationships, the name of your IT help desk tool and how your email addresses are formatted. A job post that names your VPN product gives an attacker a believable reason to call about it.
2. Pretext and hook. The attacker builds a story (the pretext) and picks a channel: email, phone, text message, collaboration chat, video call or a visit in person. The story matches what the target expects to hear, such as an invoice from a real supplier or a call from IT during a known outage.
3. Exploiting trust. A psychological lever, usually authority, urgency or helpfulness, pushes the target toward one action that skips a normal check.
4. Using the access and exiting. The attacker logs in, moves money or data, sets up persistence and often tries to delay detection, for example by setting mailbox rules that hide replies.

MITRE ATT&CK, the public knowledge base of adversary behavior, tracks these actions as techniques such as Phishing (T1566) and Phishing for Information (T1598). Mapping your defenses to those techniques helps you see which stage each control covers.

The Psychology: Why Social Engineering Works

Social engineering works because it exploits normal, useful human habits. People cooperate with authority, help colleagues, return favors and act quickly when something seems urgent. These habits keep organizations running, and attackers turn them into weaknesses.

Researchers have described these levers for decades. Robert Cialdini's book Influence set out widely cited principles of persuasion, including authority, reciprocity, liking, social proof, scarcity and commitment. In a University of Cambridge technical report, Frank Stajano and Paul Wilson studied real scams and identified seven principles that con artists exploit: distraction, social compliance, herd behavior, dishonesty, deception, need and greed, and time pressure. Their conclusion still holds: security systems should be designed around how people actually behave, instead of blaming "gullible users."

The pattern behind all of them is the same: strong emotion plus a request to skip a step. When both appear together, slow down and verify through a separate channel.

Types of Social Engineering Attacks

Social engineering attacks are usually grouped by channel (email, voice, text, in person or video) and by goal (credentials, money, access or data). The table below summarizes nine common types, followed by a closer look at each.

MITRE ATT&CK reference pages: Phishing (T1566), Spearphishing Attachment (T1566.001), Spearphishing Link (T1566.002), Spearphishing Voice (T1566.004), Phishing for Information (T1598), Replication Through Removable Media (T1091) and Internal Spearphishing (T1534).

Phishing

Phishing is the mass-market form of social engineering: messages sent to many people at once that imitate a trusted brand, service or colleague. The goal is a click on a link to a fake login page, an attachment that runs malware or a reply with sensitive data. Modern phishing pages can relay credentials and MFA codes to the real site in real time, so a one-time code typed into a fake page can still give an attacker a working session. The DBIR found phishing in 16% of breaches in 2026, the same share as the year before.

Attackers also register domains that look like yours, swapping characters that look alike. Our explainer on homoglyph attacks shows how those lookalike domains work and how to monitor for them.

Spear phishing and whaling

Spear phishing is phishing aimed at a specific person or small group, using details gathered during research: a real project name, a real manager or a recent event. Whaling is spear phishing aimed at senior executives or people with payment authority. Because the message is tailored, generic advice such as "watch for spelling mistakes" does little. What helps is a rule that certain requests, such as payment changes, gift card purchases or sharing payroll data, always need verification no matter how convincing the message looks.

Vishing

Vishing (voice phishing) uses phone calls or voicemail. Common pretexts include IT support fixing a problem, a bank fraud team "protecting" an account and an executive who needs something done right away. MITRE ATT&CK added Spearphishing Voice (T1566.004) on September 7, 2023, reflecting how often voice is now used to gain access. The 2026 DBIR notes that attackers impersonating help desk agents, or users who need a password reset, have had "moderate levels of success."

Help desks are a prime target because one reset can hand over an account. Attackers often combine a call with repeated MFA push requests, a technique ATT&CK tracks as Multi-Factor Authentication Request Generation (T1621). Our guide to MFA fatigue attacks explains that pattern.

Smishing and quishing

Smishing uses SMS and messaging apps. Common lures include package delivery problems, unpaid tolls, bank alerts and fake MFA prompts. Quishing hides the link in a QR code, often in an email or on a printed notice, so the victim scans it with a phone that sits outside corporate email filtering. The 2026 DBIR reports that in phishing simulations, the median click rate for phone-centric vectors such as voice and text is about 2%, compared with 1.4% for email. Verizon notes the phone-centric sample is small, so treat that gap as a signal, not a precise benchmark. See our explainer on QR code phishing for how these lures evade link scanning.

Pretexting

Pretexting is the story behind the request. The attacker invents a scenario, such as an auditor who needs a file, a new contractor locked out on their first day or a vendor updating its records, and plays a role to make the request seem routine. The 2026 DBIR describes pretexting as building a trusted relationship "through concocted scenarios" and reports that it reached 6% of all breaches and has become a more common initial access vector for ransomware and extortion. Verizon's practical rule is simple: if someone is interacting with you in real time to get you to do something you shouldn't, that is pretexting.

Baiting

Baiting uses something the victim wants: a free download, a gift or a "lost" USB drive labeled "Payroll" or "Confidential." When the item is opened or plugged in, it can run code or lead to a credential-harvesting page. In a controlled experiment published at IEEE Security and Privacy in 2016, researchers dropped 297 USB drives on the University of Illinois campus. They estimated an attack success rate of 45% to 98%, and the first drive was connected in less than six minutes. Most people who plugged one in said they wanted to find the owner, which is a reminder that baiting exploits kindness as well as curiosity. ATT&CK tracks the malware side as Replication Through Removable Media (T1091).

Tailgating and piggybacking

Tailgating is following an authorized person through a secure door without badging in. Piggybacking is the same thing done with the employee's knowledge, for example by holding the door for someone who looks like a delivery driver or a new colleague. Physical access can lead to stolen devices, rogue network hardware or direct access to unlocked workstations. The fix is cultural as much as technical: everyone badges in, visitors are escorted and challenging a stranger politely is expected, not awkward.

Business email compromise (BEC)

Business email compromise is fraud that uses email to redirect money. An attacker impersonates or takes over the account of an executive, supplier, lawyer or employee and asks for a wire transfer, a change of bank details or gift cards. BEC often uses no malware at all, which is why it gets past filters. In 2025, the FBI received 24,768 BEC complaints with about $3.05 billion in reported losses. When a mailbox is taken over, the attacker can reply within real email threads; ATT&CK calls this Internal Spearphishing (T1534). Our business email compromise statistics roundup covers loss trends in more detail.

Deepfake and AI voice impersonation

Generative AI lets attackers clone a voice from a short recording and produce convincing video in real time. That removes a check many people relied on: recognizing a familiar voice or face. The FBI's 2025 report counted more than 22,000 complaints with AI-related information and more than $893 million in adjusted losses, including over $30 million in BEC losses involving AI. AI also makes written lures more fluent and easier to tailor at scale. For broader trend data, see our deepfake statistics.

Other forms you may see named include quid pro quo (offering a service in exchange for access), scareware (fake virus alerts that push a "fix") and watering hole attacks (compromising a website the targets visit). They use the same levers described above.

Real Social Engineering Examples

The cases below are documented in court records, regulatory filings, government investigations or peer-reviewed research. Each shows a different channel, but the same levers: authority, urgency and trust in a familiar process.

Sources for the table: DOJ sentencing release, Ubiquiti Form 8-K, USB drop study, NYDFS Twitter investigation report, CISA advisory AA23-320A, MITRE ATT&CK Scattered Spider profile, FCC press release and The Guardian on Arup.

Fake invoices at two tech giants (2013–2015)

From about 2013 to 2015, Evaldas Rimasauskas registered a company in Latvia with the same name as a real Taiwan-based hardware manufacturer that two large US internet companies did business with. Phishing emails and forged invoices, contracts and letters directed payments to bank accounts he controlled. The US Attorney's Office for the Southern District of New York said the victims wired more than $120 million, and Rimasauskas was sentenced to five years in prison. Google and Facebook later confirmed to reporters that they were the victims. The lesson: a familiar supplier name is not verification. Bank detail changes need a callback to a number already on file.

Ubiquiti's $46.7 million transfer (2015)

In an August 2015 Form 8-K filing, Ubiquiti Networks disclosed that on June 5, 2015 it had determined it was the victim of a criminal fraud involving "employee impersonation and fraudulent requests from an outside entity" targeting its finance department. Transfers totaling $46.7 million left a Hong Kong subsidiary; at the time of filing, $8.1 million had been recovered. No system had to be hacked for this to work. The process accepted the request.

Twitter's help desk calls (2020)

The New York State Department of Financial Services investigated the July 15, 2020 Twitter breach. Its report found that on July 14, attackers called Twitter employees, claimed to be from the IT help desk responding to VPN problems, which were common after the move to remote work, and directed them to a phishing site that looked identical to the real VPN login page. As employees typed their credentials, the attackers entered them on the real site, and some employees approved the resulting MFA prompts. In total, 130 accounts were compromised, 45 were used to tweet a bitcoin scam, and the attackers collected about $118,000. The report described the techniques as akin to those of a traditional scam artist.

Scattered Spider and the help desk (2023)

On November 16, 2023, CISA and the FBI published joint advisory AA23-320A on Scattered Spider, a group that MITRE ATT&CK describes as relying heavily on social engineering, including impersonating IT and help desk staff, to gain initial access and bypass MFA. The group has also used MFA fatigue by sending repeated push requests. The defensive takeaway is to treat the help desk's identity verification procedure as a security control and test it like one.

A deepfake voice in an election (2024)

On January 21, 2024, two days before the New Hampshire presidential primary, robocalls carried a deepfake of President Biden's cloned voice telling voters not to vote. The FCC's May 23, 2024 press release said the calls also spoofed the caller ID of a local political consultant, and it proposed a $6 million fine against the political consultant responsible. The case shows how cheaply a trusted voice can now be faked at scale.

A deepfake video call at Arup (2024)

In February 2024, Hong Kong police said an employee at an unnamed company had transferred HK$200 million after a video conference with people posing as senior officers. In May 2024, the engineering firm Arup confirmed in a statement, reported by The Guardian, that it was the company involved and that fake voices and images were used. According to the police account, the money went to five local bank accounts in 15 transactions. A video call is no longer proof of identity. Large or unusual transfers need verification through a separate, pre-agreed channel.

Warning Signs of a Social Engineering Attempt

Attackers change their stories, but most attempts show several of these signs:

• An unusual request through an unusual channel, such as a payment request by text or a password reset request from a personal email address.
• Pressure to act now and a reason why normal checks cannot happen.
• Secrecy, for example "don't mention this to anyone until the deal closes."
• A request to read out or approve a code, or to accept an MFA prompt you did not start.
• Changed payment details, especially in an otherwise genuine email thread.
• Links or QR codes that lead to a login page, particularly for a service you were not trying to use.
• Offers that seem too good, or found devices and files that invite curiosity.
• A familiar voice or face asking for something out of character, which could be a deepfake.

One rule covers most of these: if a message or call asks you to bypass a normal step, verify it through a channel you already trust before you act.

How Organizations Defend Against Social Engineering

No single control stops social engineering, because the attacks target technology, processes and people at once. Effective programs layer defenses so that one mistake does not become a breach.

Technical controls

• Phishing-resistant MFA. CISA's fact sheet on implementing phishing-resistant MFA recommends FIDO2/WebAuthn and PKI-based methods because they cannot be relayed through a fake login page the way SMS codes and push approvals can. Our guide to how passkeys work explains the mechanism.
• Email authentication. Publish SPF, DKIM and a DMARC policy (RFC 7489) so others cannot easily spoof your exact domain, and flag external senders clearly.
• Link, attachment and domain protection. Use URL rewriting or time-of-click scanning, sandbox attachments and monitor lookalike domains.
• Device and media controls. Block or restrict unknown removable media and keep endpoint protection current.
• Identity monitoring. Alert on new MFA device registrations, impossible travel, new mailbox forwarding rules and bursts of MFA prompts.

Process controls

Process controls are what stop the most expensive attacks, because BEC and deepfake fraud often involve no malware at all.

People and culture

Training helps most when it builds recognition and reporting habits rather than fear. The UK National Cyber Security Centre's phishing guidance advises organizations never to punish users who fall for phishing, and warns that a culture of blame discourages reporting. Make reporting a single click, thank people who report and tell them what happened. A fast report is often what lets the security team pull a message from every inbox before others click.

Detection and response

Plan for the case where someone does click or approve. Your incident response plan should cover revoking sessions and tokens, resetting credentials, checking mailbox rules, recalling or freezing transfers and notifying banks quickly. For fraudulent transfers, speed matters: contact your bank and report to the FBI's Internet Crime Complaint Center (IC3) as soon as possible.

How Social Engineering Testing Measures Your Exposure

You cannot know how your defenses hold up until they are tested under realistic, controlled conditions. NIST's testing guide, SP 800-115, lists social engineering as a way to test "the human element and user awareness of security," and says results should be used to improve the organization's security, not to single out individuals.

Two kinds of testing are common:

• Phishing simulation programs run regularly, usually by the internal awareness team, to track reporting and click trends over time.
• Social engineering penetration tests are independent, scoped assessments that also cover channels a phishing platform does not reach, such as help desk calls and, where approved, physical entry. They measure whether processes and controls hold up, not just whether someone clicked.

The most useful measures are the report rate, the time to first report, the share of people who entered credentials, whether help desk staff followed verification procedures and how quickly the security team contained the test. Our guide to social engineering penetration testing covers test types, rules of engagement, metric definitions and how to read results without blaming staff.

What to Do If You Fell for a Social Engineering Attack

Acting quickly limits the damage. If you clicked, shared or approved something you should not have:

1. Report it immediately to your security team or IT. Speed matters more than embarrassment.
2. Change the affected password from a trusted device, and sign out of other sessions.
3. Tell the security team about any MFA prompts you approved or codes you shared.
4. If money was sent, contact your bank right away to request a recall, then report to IC3 or your local police.
5. Do not delete the message. Forward it as instructed so responders can find other copies.

Frequently Asked Questions

What are the four types of social engineering?

There is no single official list. Many sources group attacks by channel into four families: email phishing (including spear phishing and BEC), voice phishing (vishing), SMS and messaging phishing (smishing) and in-person methods such as pretexting, tailgating and baiting. Deepfake impersonation now adds a fifth channel: video and cloned voice.

What is the most common type of social engineering?

Phishing. The 2026 DBIR found phishing in 16% of breaches, and the FBI's 2025 Internet Crime Report listed phishing and spoofing as the most reported complaint type, with 191,561 complaints.

What is an example of social engineering?

A caller claiming to be from IT says your VPN is broken and directs you to a login page to fix it. This is what happened in the 2020 Twitter breach, where 130 accounts were compromised after employees entered credentials on a fake VPN site.

What is the difference between phishing and social engineering?

Social engineering is the broad category: any manipulation of people to compromise security. Phishing is one type of social engineering, delivered through messages such as email. Vishing, smishing, pretexting, baiting and tailgating are other types.

Is pretexting the same as phishing?

No. Phishing usually sends a message and waits for a click. Pretexting builds a scenario and interacts with the victim, often in real time, to get information or an action. Many attacks combine both: a phishing email starts the contact and a follow-up call completes the pretext.

Can AI deepfakes be used for social engineering?

Yes. Cloned voices and real-time deepfake video have been used to request transfers, as in the 2024 Arup case, and to spread disinformation, as in the January 2024 New Hampshire robocalls. The defense is to verify sensitive requests through a separate channel agreed in advance.

How do you prevent social engineering in an organization?

Combine phishing-resistant MFA and email authentication with process rules (callbacks for payment changes, strong help desk identity checks), simple and blame-free reporting, and regular testing to find where those controls fail.

Next Step: Test Your Defenses Against Social Engineering

Social engineering will keep changing channels, from email to text, voice and deepfake video, but it relies on the same levers. The organizations that resist it best verify sensitive requests out of band, use phishing-resistant authentication, make reporting easy and test whether those controls work in practice.

DeepStrike's penetration testing services include social engineering assessments that simulate real-world attacks such as phishing, calling and baiting. For objective-based campaigns where social engineering is the entry point, see our red teaming services. To discuss scope, contact DeepStrike.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• NIST CSRC Glossary: Social engineering
• NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
• Verizon 2026 Data Breach Investigations Report
• FBI Internet Crime Complaint Center: 2025 Internet Crime Report
• Stajano and Wilson, Understanding scam victims: seven principles for systems security, University of Cambridge UCAM-CL-TR-754 (August 2009)
• Tischer et al., Users Really Do Plug in USB Drives They Find, IEEE S&P 2016
• New York State Department of Financial Services: Twitter Investigation Report (October 2020)
• US Attorney's Office SDNY: Lithuanian man sentenced to 5 years in prison for theft of over $120 million
• Ubiquiti Networks Form 8-K (August 2015), SEC EDGAR
• CISA and FBI advisory AA23-320A: Scattered Spider
• MITRE ATT&CK: Scattered Spider (G1015)
• FCC: Proposed $6 million fine for Biden deepfake robocalls (May 23, 2024)
• The Guardian: UK engineering firm Arup falls victim to £20m deepfake scam (May 17, 2024)
• CISA: Implementing Phishing-Resistant MFA fact sheet (October 2022)
• UK National Cyber Security Centre: Phishing attacks, defending your organisation
• IETF RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• MITRE ATT&CK: Phishing (T1566)
• MITRE ATT&CK: Spearphishing Voice (T1566.004)
• MITRE ATT&CK: Phishing for Information (T1598)
• MITRE ATT&CK: Multi-Factor Authentication Request Generation (T1621)
• MITRE ATT&CK: Replication Through Removable Media (T1091)
• MITRE ATT&CK: Internal Spearphishing (T1534)