Social Engineering Attacks Explained

Social engineering means getting a person to hand over information or access, rather than breaking into a system with technical tools. The attacker aims at the human, using trust, urgency, helpfulness or fear.

This guide covers the definition, the main tactics with examples, why they work and how to defend yourself. It draws on NIST, CISA and university security offices, and the sources were checked on October 22, 2026.

The short answer

NIST describes social engineering as an attempt to fool someone into giving up information, such as a password, that could be used against systems or networks. Phishing is the best-known type, but it is only one.

The strongest defense is to slow down, confirm the request through a channel you trust, and never act because of pressure alone.

Social engineering definition and meaning

CISA says that in a social engineering attack, the attacker uses social skills and human contact to learn about or compromise an organization or its computer systems.

The attacker may come across as ordinary and respectable. CISA's example is someone posing as a new employee, a repair person or a researcher, who may even show credentials to back up the story.

Social engineering attacks rely on which of the following

If you are answering a quiz question, the answer is human interaction and manipulation, not a software flaw. CISA describes the attacker using social skills.

A University of California Berkeley guide says these attacks recreate normal interactions and use a victim's natural tendencies, such as wanting to be helpful, or worry and fear, so that people react without thinking.

Why social engineering works

This section is our analysis, built on the sources. Most people want to help, respect authority and avoid trouble. Attackers use each of those habits.

CISA also notes that attackers use a false sense of urgency. Berkeley's guide adds that attackers often begin with research, looking for public information they can use against you.

How an attack builds

CISA describes a pattern. When one source does not give an attacker enough, they approach another person in the same organization and use what the first one revealed to sound credible.

That is why a small, harmless-looking detail, such as a manager's name, can matter. Each answer makes the next request easier to believe.

Social engineering tactics

This table lists the common tactics. The definitions follow Berkeley, City College of San Francisco and CISA, and the examples are from those sources.

Tactic	How it works	Example
Pretexting	A believable story gets you to share information or act	A spoofed email from an administrator asking for action
Baiting	Bait tempts curiosity or greed	An infected USB drive labelled Confidential
Quid pro quo	Something is offered in exchange for something else	A fake IT technician asking for a password to provide service
Tailgating	Someone follows an authorized person into a restricted area	Following an employee through a door
Phishing	Email or a malicious site poses as a trusted organization	A message seeming to come from your bank about a problem
Vishing	Voice calls, often with a spoofed caller ID	A call asking you to confirm account details
Smishing	SMS messages with links	A text with a link that opens a page
Honeytrap	Fake accounts on dating sites target victims	A romance scam

Pretexting

Pretexting means building a convincing story. City College of San Francisco's guide gives two examples: a text from a friend asking for help when their phone was just stolen, and a forged email from a senior administrator.

Berkeley notes that scammers use the pretext to get a foot in the door, then steal personal information. Its advice is to verify who is contacting you by calling the relevant company directly.

Baiting and quid pro quo

Baiting offers something tempting. City College's examples are an infected USB drive left for a curious person, and a site offering free music or movie downloads that are infected.

Quid pro quo means something for something. Berkeley says it is like baiting, but the benefit is usually a service. A caller posing as IT support who wants your password is the classic case.

Tailgating

Tailgating happens when someone without access follows you into a secure area. Berkeley's advice is simple: watch who comes in behind you.

It works because holding a door open feels polite. Our advice is to ask visitors to sign in or use a badge, even if it feels awkward.

Phishing, vishing and smishing

CISA calls phishing a form of social engineering in which email or malicious websites pose as a trustworthy organization to request personal information.

It describes vishing as social engineering by voice, which can use internet phone services to spoof caller ID, and smishing as social engineering through text messages with links.

Social engineering scams

Many scams are social engineering with a payoff. A fake support call, a romance profile or a parcel diversion all work by building trust first.

The University of Technology Sydney's guide lists diversion theft, where couriers are tricked into delivering a package somewhere else. If a scam captures your personal details, our guide to what to do after identity theft shows the next steps.

Business email compromise and payment fraud

The FBI defines business email compromise, or BEC, as a sophisticated scam targeting business email accounts through social engineering or computer intrusion.

Attackers pose as executives, suppliers or finance staff and push for urgent payments or changed bank details.

The FBI advises confirming transfer requests using previously known phone numbers, not numbers in the email, and adding a secondary sign-off for changes to vendor payment details. It also asks victims to file an IC3 complaint regardless of dollar loss.

Our guide to business email compromise explains prevention step by step.

Social engineering in cyber security

Technical controls help, but they cannot stop a person from approving a request.

That is why strong, phishing-resistant sign-in matters. Our guide to MFA methods ranks them, because even a stolen password is harder to use against a strong method.

Social engineering vs phishing

People use the two terms as if they meant the same thing. They do not. Social engineering is the whole family of tricks that manipulate people. Phishing is one member of that family, delivered by email or a fake website.

CISA's guidance on avoiding social engineering and phishing treats vishing, which uses voice calls, as another approach in the same family. So a phone call, a text, a visitor at your door and an email can all be social engineering.

The attack lifecycle from the attacker's side

It helps to see an attack as a process. This five-step model is ours, and it fits most cases.

Every step has a defense. You limit the research by sharing less. You question the approach by verifying identity. You slow the exploit by requiring a second check. You shorten the exit by reporting quickly.

Spear phishing, whaling and clone phishing

Three terms come up often. NIST's glossary describes spear phishing as a colloquial term for any highly targeted phishing attack. The attacker writes to one person or one small group, using details that make the message feel personal.

Whaling is the name people use when the target is a senior executive.

Clone phishing is when an attacker copies a genuine message that you already received and sends it again with a harmful link or attachment. Those two definitions are common usage, not formal standards.

The common thread is relevance. A message that mentions your real manager, your real project or a real invoice is far more convincing than a mass email about a prize.

AI voice and video fraud

The FBI warned in December 2024 that criminals use generative artificial intelligence to commit fraud on a larger scale and make their schemes more believable. It said the technology reduces the time and effort criminals need to deceive people.

The FBI's alert gives examples across text, images, audio and video.

It describes AI-generated audio, called vocal cloning, used to impersonate public figures or personal relations to get payments, and AI-generated video used in real-time chats with someone pretending to be an executive or an official.

Its advice is practical. Create a secret word or phrase with your family to verify identity. Listen closely to tone and word choice on a call.

Limit the amount of your image and voice that is public, make social media accounts private and limit followers to people you know.

What this means in practice

A familiar voice or face is no longer proof of identity. If a call or video asks for money, secrets or urgent action, verify through a second channel that you chose, such as a number you already had.

QR code phishing

Quishing is phishing through a QR code. The code hides the address, so you cannot see where it leads until you scan it. Attackers place codes on stickers, flyers, parking signs or emails.

Our advice is to treat a QR code like a link from a stranger. Preview the address before opening it, be wary of stickers placed over other codes and never enter a password after scanning without checking the site address.

Scareware and fake alerts

Scareware uses fear. A pop-up claims your computer has a virus and tells you to call a number or install a tool. The tool is the attack, and the person on the phone is the attacker.

Real security software does not ask you to phone a stranger. Close the page, and if the window will not close, restart your browser and do not call the number.

Situations and what to do

These are common cases. The response in each follows one rule: verify using a channel that you choose, not one the message gives you.

Situation	What to do
Your manager emails an urgent request to buy gift cards	Phone your manager on a number you already know
Someone from IT asks for the code from your authenticator app	Refuse. Real support never needs your one-time code
A text says a parcel is held and asks you to pay a small fee	Do not use the link. Open the carrier's app or site yourself
A caller says they are from your bank and your account is at risk	Hang up and call the number on your card
A supplier sends new bank details by email	Confirm by phone using a contact already on file
A stranger asks you to hold a secure door	Direct them to reception or a badge reader

CISA's guidance says to be suspicious of unsolicited phone calls, visits or messages from individuals asking about employees or internal information.

It says that if an unknown person claims to be from a legitimate organization, you should try to verify their identity directly with the organization.

How to protect yourself

CISA advises treating unsolicited calls, visits or emails that ask about employees or internal details with suspicion. If a person says they represent a legitimate organization, check that claim.

This section is our advice, built on those sources.

At work

Organizations add rules on top of personal habits. This section is our analysis: clear procedures for access and payments, training, and an easy way to report suspicious contact.

With a clear process, employees do not have to assess every request by themselves. A script such as call back on a known number removes the pressure.

Falling for social engineering does not mean someone is careless. The attacks use ordinary trust and politeness, so good procedures let employees verify a request without fear of being blamed for the delay.

Create a culture where people report

Attacks succeed when victims stay quiet. A person who clicked a link and says nothing for a day gives the attacker a day. Make reporting easy and make it safe.

Provide one obvious way to report, such as a button or a shared address.

Thank people who report, including those who made a mistake, because that is how problems are caught early. Never punish a quick report. Punishing people teaches them to hide.

What to do if you were tricked

Speed matters more than perfection. These steps are our advice. Do them in order, and tell someone at work if it is a work account.

1. Stop engaging: Do not reply, and do not call back the number they gave you.
2. Change passwords: Change the passwords for any account you shared, starting with email, and turn on multifactor authentication.
3. Contact your bank: If money or card details were involved, call your bank right away using the number on your card.
4. Check for damage: Look for unknown sign-ins, forwarding rules and new devices on your accounts.
5. Report it: The FBI says victims of financial fraud should file a report with the Internet Crime Complaint Center.

Our guide to changing your passwords after a breach covers the password step in detail.

Training that works

Short, regular training beats one long yearly session. Use real examples from your own inbox, with details removed. Run simulated phishing messages only if you also teach people afterward and never shame those who click.

Measure the share of people who report suspicious messages, not only the share who click. A rising report rate shows that the habit is growing.

Protecting your family

Social engineers target households too. Older relatives are often the targets of fake emergency calls, so agree on a family secret word, as the FBI suggests, and explain that a real emergency can wait one minute for verification.

Review what you share publicly. Voice clips, birthdays, workplace details and family names help attackers sound convincing. Our iPhone privacy settings guide and Android guides cover how to tighten what apps and profiles reveal.

Frequently asked questions

What is social engineering?

Manipulating people into giving up information or access. NIST describes it as tricking someone into revealing information such as a password.

What are social engineering attacks?

Tactics such as phishing, vishing, smishing, pretexting, baiting, quid pro quo and tailgating that aim at people.

Is phishing social engineering?

Yes. CISA calls phishing a form of social engineering.

What is an example of social engineering?

A caller posing as IT support who asks for your password, or an infected USB drive left where someone will find it.

How do I avoid social engineering?

Slow down, verify requests through a trusted channel and never share credentials on request.

What is the difference between social engineering and phishing?

Phishing is one type of social engineering, delivered through email or fake websites. Social engineering also includes calls, texts and in-person tricks.

Can a voice or video call be faked?

Yes. The FBI warns that criminals use AI to clone voices and create video. Verify through a second channel and consider a family secret word.

What is quishing?

Phishing delivered through a QR code, which hides the address until you scan it.

A quick checklist

• Treat urgency and pressure as warning signs.
• Verify requests using contact details you already have.
• Do not plug in found USB drives.
• Do not hold doors for strangers without checking.
• Report suspicious contact.

Up nextMFA methods ranked from weakest to strongestStrong sign-in limits the damage when someone is fooled. Read our guide to MFA methods ranked from weakest to strongest.→