What is social engineering?
Social engineering attacks the person instead of the system. Rather than finding a software flaw, the attacker persuades someone to do the work: type a password into a fake page, approve an MFA prompt, reset an account, wire money, open an attachment or hold a door. It works because people are trained to be helpful, to respond to authority and to act quickly, and because a convincing request looks exactly like normal work.
Breach investigations consistently rank phishing and other people-focused attacks among the most common ways attackers first get in, which is why both technical controls and awareness training are aimed at it.
The principles behind the pressure
| Principle | How the attacker uses it | Example wording |
|---|---|---|
| Authority | Claims to come from someone the victim must obey | Per the CFO's instruction |
| Urgency | Imposes a short deadline | Your account locks at noon today |
| Intimidation | Threatens consequences | Failure to respond will be reported to HR |
| Scarcity | Offers something in limited supply | Only 25 upgraded laptops remain |
| Consensus | Claims others have already complied | 300 colleagues have completed this step |
| Familiarity | Uses names, brands or threads the victim knows | A reply inside a real vendor thread |
| Trust | Poses as a helper or builds a relationship first | IT here, following up on your ticket |
Most lures combine two or three. Urgency is among the most common, because a deadline discourages the victim from stopping to check.
Common social engineering attacks
- Phishing by email, narrowed to a researched target as spear phishing or to an executive as whaling
- Smishing by text message, vishing by phone call and quishing through QR codes
- Business email compromise, which uses spoofed, look-alike or taken-over accounts to redirect payments
- Impersonation and pretexting, posing as a trusted person or role with a believable cover story
- Deepfakes, synthetic voice or video of a real person
- Watering hole attacks, which compromise a site the targets already trust
- Typosquatting, look-alike domains that catch mistyped addresses and lend phishing credibility
- Physical techniques such as tailgating and shoulder surfing
Example: a call to the help desk
A caller tells the service desk he is a regional sales manager who lost his phone at an airport and needs his MFA reset before a client meeting. He knows his employee ID, his manager's name and his start date, all of which an attacker can find on professional networking sites or in breach data. He is friendly, then impatient, then mentions the vice president who is waiting on him. According to widely reported accounts, the 2023 breach of MGM Resorts began with a call like this. The defense is procedure: call back the number on file in the HR system, confirm with the manager through a separate channel, and never accept facts a stranger could look up as proof of identity.
Defending against social engineering
- Security awareness training and phishing simulations that teach people to slow down, verify and report, measured by report rates as well as click rates
- Verification through a channel the requester doesn't control, such as a callback to a known number, never one supplied in the message
- Process controls for money and access, such as dual approval for payments and for changes to bank details
- Phishing-resistant MFA, such as FIDO2 security keys and passkeys, which won't authenticate to a look-alike site
- Email authentication (SPF, DKIM and DMARC), external-sender tags and a one-click report button
- A culture in which staff may challenge anyone, including executives, without blame
Social engineering on the CompTIA Security+ exam
Social engineering runs through several SY0-801 objectives. Objective 2.5 covers recognizing social engineering attacks such as phishing, smishing, vishing, quishing, impersonation and deepfakes from a scenario's details. Objective 2.3 lists human-based threat vectors, including impersonation, contractors, visitors and watering holes. Objective 5.6 covers the security awareness training that defends against it. Identify the variant by its channel (email, text, call, QR code) and its target (everyone, a named person, an executive). For prevention questions, the best answer usually verifies the request outside the original channel; antivirus and email encryption are common wrong answers, because social engineering often carries no malware and encryption does nothing to confirm who is asking. Social engineering also appears in A+ Core 2 (220-1202) objective 2.5.