So what is social engineering in cyber security? It is the art of manipulating people into giving up confidential information, by exploiting emotions such as fear, uncertainty and trust. Verifying any unexpected request independently is the core defence.
The sections below follow an attack from first contact to the final request, then compare email, phone, text and in-person channels. Readers working through the security+ exam vorbereitung material will find this topic sits alongside the other human-factor and threat basics there.
How social engineering works
Social engineering targets the person, not the software. Washington University in St. Louis describes it as an attempt to manipulate people by exploiting psychology and emotions such as fear, uncertainty and trust. UNLV’s IT team adds that attacks can arrive through emails and text messages, in person, over the phone or on social media.
Most attacks follow a recognisable order, even when the channel changes.
- Gather background. Attackers do not ask one person for everything they need. UNLV notes they collect seemingly harmless information from many sources and combine it.
- Choose a trusted role. The attacker poses as someone the target has reason to believe or obey, such as a coworker, a bank representative or a member of the IT department.
- Apply emotional pressure. Washington University points out that emails saying “urgent!”, using pressure tactics or preying on fear are especially suspect.
- Collect the result. The target hands over a password or card number, follows a link, buys a gift card or opens a door.
Because the weak point is a human reaction rather than a software flaw, the useful defences are procedural. Pausing at stage three and checking the request through a separate route breaks the chain before stage four. The next section looks at the channel where that chain is most often seen.
Phishing and spear phishing
Phishing is the fraudulent practice of sending emails that purport to be from reputable companies, in order to obtain passwords and card numbers, according to Washington University’s information security office. The email is the whole delivery mechanism, so the sender, the wording and the link are what a reader has to inspect.
Spear phishing versus phishing
The difference between spear phishing and phishing is targeting. Spear phishing targets specific individuals with tailored messages, whereas ordinary phishing imitates a reputable company to reach whoever receives the email.
- Phishing: a message presented as coming from a reputable company, aimed at collecting credentials or payment details.
- Spear phishing: a message shaped around a named recipient, which fits the earlier background-gathering stage.
A message that looks written for you is therefore no proof that it is legitimate. Judge the request itself: what it asks for, how much pressure it applies and whether the sender can be confirmed another way.
Vishing and smishing
Vishing and smishing move the same manipulation onto phones. Vishing, short for voice phishing, consists of calls from attackers who impersonate government agencies, software vendors or benefit services. Smishing is phishing delivered by SMS text message.
Both channels share a weakness that email lacks. Washington University explains that flaws in how caller ID and phone number verification work make these attacks hard to stop. A number shown on the screen is therefore not evidence of who is calling or texting.
The practical answer is to end the contact and verify. UNLV advises locating the company’s legitimate phone number independently to check the person’s claim, rather than using a number supplied in the call or message. This suits everyone, since it needs no technical skill, only the habit of making the next call yourself.
Physical social engineering and tailgating
Social engineering does not stop at the screen. According to SentinelOne, tailgating lets attackers slip into secure areas by following authorised personnel. The attacker relies on ordinary politeness rather than on defeating a lock.
UNLV’s guidance is direct: do not allow someone entrance into buildings or rooms restricted by key access. Holding a door is a courtesy in most places, but at a restricted door it is the attack itself. Staff who feel awkward refusing are the main reason this technique works, which is a good topic for team discussion.
Channel differences at a glance
The manipulation is the same across channels, but the lure and the warning sign differ. This comparison shows what changes.
| Channel | Attack | Typical lure | What it means for you |
|---|---|---|---|
| Phishing, spear phishing | Messages purporting to be from reputable companies, or tailored to a specific person | Urgent, pressure-based wording is the clearest cue | |
| Phone call | Vishing | Callers impersonating government agencies, software vendors or benefit services | Caller ID cannot be taken at face value |
| Text message | Smishing | Phishing delivered by SMS | Number verification flaws make these hard to stop, so verify elsewhere |
| In person | Unauthorised entry | Requests to be let into buildings or rooms restricted by key access | The failure point is admitting an unknown person |
These channel details draw on Washington University’s social engineering guidance and UNLV’s best practices.
Social engineering examples
The documented scenarios below show how the stages play out in practice.
- Pretexting. The attacker invents a role. SentinelOne describes it as impersonating someone trusted, like a coworker or a bank representative, to elicit information.
- Authority impersonation. UNLV gives the example of a person claiming the IT department sent an installer, relying on the target’s deference to authority.
- Boss impersonation. Washington University describes a victim receiving an urgent request to buy a gift card for someone posing as their boss. Messages that pose as a senior colleague to obtain payments or information belong to the pattern commonly called business email compromise. The same urgent request can come from someone posing as a friend or relative.
- Baiting. SentinelOne notes that baiting lures victims with an attractive offer, such as free downloads, gift cards or USB drives left in public.
Each example combines a believable identity with a time-pressured request. Recognising that combination is more reliable than memorising individual scams, since the details change but the structure does not.
Red flags checklist and how to report
Use these checks whenever a message, call or visitor asks for something unexpected.
- Urgency or fear. Washington University flags emails that shout “urgent!”, use pressure tactics or prey on fear as especially suspect.
- Requests for secrets.
- Borrowed authority. A claim to speak for IT, a bank, a government agency or your boss is a reason to check, not a reason to comply.
- Money by unusual routes. A rushed gift card purchase for a supposed superior fits the documented boss-impersonation pattern.
- Unknown people at restricted doors. Do not let strangers into key-restricted rooms.
For suspicious email links, Washington University advises typing in the URL or searching for the organisation instead of clicking. To confirm a request for personal or sensitive information, call the organisation on a number you found independently.
Reporting follows verification. At Washington University, staff forward the suspicious email to [email protected] and then delete it from the inbox. In other organisations, use the reporting address or process your IT or security team publishes, and avoid replying to the sender.
Security awareness training as a defence
SentinelOne calls advanced security awareness training a key defence against social engineering, and adds that regular training and simulated phishing exercises help reinforce vigilance. Training suits organisations best, because it turns the checklist above into a shared habit and gives staff a normal way to challenge a request or a stranger at a door.
Individuals without a formal programme can apply the same idea by rehearsing the verification step: decide in advance that any unexpected request for information gets a check through a separate channel.
Beyond the human layer
Manipulation is only one part of the threat picture. Where a successful lure leads to malicious software, the guide to types of malware explains the main categories. For the technical side of protecting data, which this guide leaves aside, see symmetric vs asymmetric encryption.
Frequently asked questions
Is phishing the same as social engineering?
No. Phishing is one form of social engineering, delivered by email. Social engineering also covers calls, text messages, social media and in-person approaches such as tailgating.
Can caller ID prove who is calling?
No. Washington University notes that flaws in how caller ID and phone number verification work make vishing and smishing hard to stop, so verify the claim through a number you find yourself.
When are these attacks most common?
Washington University says they are especially common during times of upheaval and uncertainty, such as natural disasters, pandemics and economic volatility. Extra caution with unexpected requests is sensible in those periods.
Why do attackers gather small details first?
UNLV explains that attackers do not ask one person for all the information they need. They collect seemingly harmless pieces from many sources, so a request that seems trivial on its own can still be part of a larger attempt.
