Social Engineering: The Human Side of Cyberattacks

Social engineering is manipulating a person, not breaking a system, to get passwords, money, or access. Attackers pose as someone you trust and create urgency so you act before you think. The best defense is a habit: when anyone asks for money, a code, or access, stop and verify through a channel you already know is real, never the one they gave you.

Most people picture hackers defeating firewalls. In practice, it’s usually easier to call someone and ask. Social engineering works because it targets how people naturally behave: we trust authority, we respond to urgency, and we want to be helpful. That makes it the common thread behind phishing, vishing, tech support scams, and impersonation fraud, and no software patch fixes it.

A Real Example: Attackers Who Just Called the Help Desk

In November 2023, the FBI and CISA published a joint advisory on a criminal group known as Scattered Spider. The advisory describes a group that targets large companies and their contracted IT help desks, mainly to steal data for extortion. Its main tools were conversations, not malware:

• Phone and SMS impersonation. The attackers posed as company IT or help desk staff to get employee credentials or to talk employees into installing remote-access tools.
• Pressuring real help desk staff into resetting passwords or multi-factor authentication tokens.
• MFA “push bombing,” sending repeated approval prompts until a worn-down user taps “approve.”
• One-time passcode theft, convincing people to read their code aloud.
• SIM swapping, persuading a phone carrier to move a target’s number to a SIM the attackers control.

Every technique on that list relies on a person making a quick, trusting decision. The advisory’s recommended defense for organizations includes phishing-resistant multi-factor authentication, which resists push bombing and SIM swaps. Read the advisory.

The same playbook is used against individuals: a “bank fraud department” calls, a “tech support agent” asks you to install software, a “carrier” says your account is compromised.

The Cost Is Real

The FBI’s Internet Crime Complaint Center (IC3) 2025 report shows how much of this is impersonation-driven. Among the 2025 figures:

IC3 defines tech support fraud and government impersonation by the impersonation itself. It describes business email compromise as carried out through social engineering or computer intrusion. IC3 2025 Internet Crime Report (PDF).

Common Types of Social Engineering

• Phishing. Fake emails that push you to click a link or enter credentials. See our guide to spotting a phishing email.
• Spear phishing. Phishing tailored to you, using details such as your employer, a recent purchase, or a family member’s name.
• Smishing. The same trick over text message. See text scams.
• Vishing. Phone calls from fake banks, agencies, or tech support. See vishing, QR code scams, and social media fraud.
• Pretexting. An invented scenario that sounds plausible, such as “I’m calling from your bank’s fraud team,” used to extract information.
• Baiting. An infected USB drive left where you’ll find it, or a “free” download that carries malware.
• Tailgating. Following someone through a secure door by looking like you belong.
• Impersonation by voice or video. AI-cloned voices of relatives or executives. See AI voice cloning scams.

Why It Works

Attackers exploit habits that are normally helpful:

• Authority. We comply with people who sound official, like police, a bank, or IT.
• Urgency. “Act now or your account closes” leaves no time to verify.
• Fear and reward. Threats of arrest or promises of a refund both bypass careful thinking.
• Familiarity. Details from your social media make an approach feel personal and credible.
• Fatigue. Repeated prompts and calls wear down resistance.

How to Protect Yourself

1. Slow down. Urgency is the main tool. A real problem will survive a five-minute check.
2. Verify through a channel you control. Hang up and call the number on your card or statement. Open the company’s app yourself. Don’t use the contact details in the message.
3. Never share one-time codes or approve a login prompt you didn’t start. A real company will not ask you to read a code back.
4. Use the strongest multi-factor authentication available, and treat unexpected prompts as an alarm. See our two-factor authentication guide.
5. Limit what you share publicly. Birthdays, pet names, and workplaces help attackers sound credible. See 7 smart privacy habits.
6. Use a password manager, so a fake login page can’t capture a password the manager refuses to fill in. See our password manager comparison.
7. Agree on a safe word with family for emergency requests, as a defense against cloned voices.
8. Be wary of unknown USB drives and “free” downloads.
9. Keep software updated, so malware delivered by a successful trick has fewer ways in.

What to Do If You Think You’ve Been Targeted

The FTC’s guidance covers the main cases:

1. If you only received the message, don’t click, reply, or call back. Report it and delete it. Forward phishing emails to reportphishing@apwg.org and texts to 7726 (SPAM).
2. If you clicked a link or opened an attachment, update your security software, run a scan, and remove anything it flags.
3. If you shared a password, change it right away on that account and anywhere you reused it, and turn on multi-factor authentication.
4. If you gave out a Social Security, card, or bank account number, go to IdentityTheft.gov for recovery steps matched to what was exposed, and call your bank or card issuer using the number on your card.
5. If you sent money, contact your bank immediately. Speed matters.
6. Report it to the FTC at ReportFraud.ftc.gov and the FBI at ic3.gov.

Source: FTC, How to Recognize and Avoid Phishing Scams.

People Also Ask

Sources: CISA and FBI, “#StopRansomware: Scattered Spider” (Advisory AA23-320A, November 2023); FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Federal Trade Commission, How to Recognize and Avoid Phishing Scams