What is social engineering

Social engineering is the psychological manipulation of people into performing actions or disclosing sensitive information against their own interests. Attackers go after human behavior instead of your systems, exploiting trust, fear, urgency, and curiosity to bypass technical controls, harvest login credentials, and execute financial fraud. While conventional cyberattacks target system vulnerabilities, such as misconfigurations in cloud or network instances, weak API authentication, or unpatched software, social engineering targets human judgment.

What is Social Engineering: A Human Definition

MITRE ATT&CK classifies social engineering techniques under the Initial Access and Reconnaissance tactics, since most enterprise breaches begin with a person trusting the wrong message, request, or caller.

Think of it as an attack on the “trust layer,” the human tier that sits above your technical controls and makes the final call on whether a financial transfer is approved, a credential is reset, or a malicious link is clicked. You can’t put a firewall around the trust layer, and SIEM systems can’t alert on it in real time, because a decisive event like a Slack DM that ends in a wire transfer approval, a vendor call that ends in a credential reset, or a Teams message that ends in a malicious file download does not generate the kind of signal your detection stack was built to ingest. By the time the breach appears in logs, the trust layer has already been compromised. How exposed your employees are depends on the quality of your training and the rigor of your verification protocols.

Many companies keep suffering breaches despite strong endpoint protection and a continuously monitored firewall. According to Verizon’s 2026 Data Breach Investigations Report, roughly 62% of breaches occur due to human error, misuse, or social engineering. The same report found pretexting on the rise and attackers using AI across a median of 15 documented attack techniques. The human-element share has stayed above 60% for years, despite more security awareness.

The numbers stay steady because social engineering doesn’t need to breach your perimeter. It convinces your employees to open it from the inside. In 2026, with large language models making personalised impersonation cheap, voice-cloning software making audio untrustworthy, and collaborative platforms such as Slack and Teams adding attack surfaces that organizational legacy security tools were never designed to cover, the window for detection has narrowed faster than most organizations admit.

This guide covers what social engineering looks like today and what your teams need to know before the next attack reaches your inbox.

13 Types of Social Engineering Attacks

Each type below maps to real, documented incidents in our library of social engineering examples.

Digital Impersonation

• Phishing remains the dominant initial access vector. The IBM X-Force Threat Intelligence Index tracks phishing as one of the most common ways attackers get in. Bulk phishing casts wide nets across workforces, while spear phishing targets specific individuals with personalized context. Whale phishing targets executives, and Business Email Compromise (BEC) exploits compromised legitimate accounts that bypass most security software.
• Smishing moves the attack to SMS. People answer texts faster and with less scrutiny than email, and attackers count on that.
• Vishing uses voice, and now increasingly, AI-cloned voice, to impersonate executives, IT staff, or vendors over the phone. Voice authentication as an identity verification mechanism is no longer reliable.
• Quishing embeds malicious QR codes in emails, PDFs, and physical materials. The attack bypasses email security filters entirely and routes targets to mobile browsers with reduced security coverage.
• Deepfake fraud deploys AI-generated audio and video to impersonate executives or colleagues in live or recorded interactions. Deepfake-assisted fraud is already happening, and it’s growing.
• Collaboration platform impersonation exploits the trust employees extend to messages from internal channels. When an attacker compromises a real internal account, the impersonation is invisible to standard detection because the message appears to originate from a legitimate, authenticated user within your company.
• Signals to watch include anomalous login geography (for example, an account that has logged in from London for three years suddenly authenticating from a residential IP in another country), message volume spikes, off-hours activity, and lateral DM behavior, where an account that has always messaged suddenly initiates direct contact with people across unrelated departments. These are the patterns that User and Entity Behavior Analytics (UEBA) tools and collaboration-platform security overlays such as Material Security, Nudge Security, and Push Security are designed to surface.

Access Manipulation

• Pretexting builds a made-up context to make a request seem legitimate. A common version has attackers pose as bank representatives contacting your finance team about a reported security incident and asking for account verification.
• Help desk deception targets support teams with urgent credential reset or account access requests from attackers posing as employees. Verification workflows that use a separate, pre-established channel are the primary defense, and they are frequently absent.
• MFA fatigue is a condition in which an attacker repeatedly sends multi-factor authentication prompts until a frustrated or confused target accepts one. It shows up in high-profile enterprise breaches and can only be caught through behavioral analysis. SOC teams identify it in authentication logs as a cluster of failed or denied MFA challenges, followed by a single approval for the same account, originating from an IP or device the user has not previously authenticated from, generally outside normal working hours. The 2022 Uber and Cisco breaches both involved this pattern, and it remains a recurring initial-access technique in Scattered Spider intrusions.
• Tailgating requires no technical skill whatsoever. An unauthorized person follows an authorized employee through a secured door, relying on courtesy and distraction. Physical security protocols and awareness training are the only countermeasures in such cases.

Incentive and Lure Tactics

• Baiting offers something desirable, like a free software download, gift cards, or exclusive content, in exchange for a click or a credential. The Nigerian Prince scam is the best-known example. The scam still generates $700,000 per year, decades after it became widely known.
• Honeytrapping uses a fake romantic or flirtatious relationship to compromise high-value targets, often people in C-suite roles.
• Quid pro quo exchanges something of perceived value for system access or sensitive information. Attackers posing as IT support offering to resolve a fabricated technical issue in exchange for remote access is a common pattern.
• Fake surveys and prize notifications masquerade as routine customer interactions to harvest personal information or redirect targets to credential-collection sites.

The Anatomy of a Social Engineering Attack

Modern social engineering attacks follow a structured, four-phase operational sequence. Knowing these phases is the first step in defending against them.

Phase 1: Reconnaissance

The attacker starts by doing their homework. They scrape public sources like LinkedIn profiles, corporate websites, press releases, and social media to get a detailed map of your organization: who sits in finance, who has approval authority for wire transfers, what vendors you use, and what language your executives typically use in communications. The more detailed the reconnaissance, the more convincing the attack. For enterprise targets, this phase can span days or weeks.

All reconnaissance data gathered comes together to form a convincing pretexting script, which needs five parts: a persona, a scenario, credibility anchors, an action ask, and a pressure mechanism.

An attacker pulls your CFO’s LinkedIn profile and notes the date she joined. Your investor relations page lists a Q3 earnings call for next Tuesday. A press release from three weeks ago names your new APAC banking partner. Your accounts payable (AP) clerk’s LinkedIn shows he reports to a controller who was on leave last week. That’s enough for the attacker to write the script. The persona is the APAC partner’s relationship manager. The scenario is a routine wire tied to the earnings cycle. The credibility anchors are the partner’s real name, the CFO’s previous-firm vocabulary, and the controller’s documented absence, which explains why the request lands with the AP clerk rather than being escalated. The ask is to approve the wire before close of business. Four hours of open-source research can be enough to build a request your AP clerk has no plausible reason to refuse.

Phase 2: Trust Establishment

The attacker presents a fabricated identity to establish a connection. Common identities assumed by attackers include an IT support staff member requiring urgent credential verification, a vendor representative following up on an outstanding invoice, or a known executive requesting an out-of-band bank transfer. Some attacks need patience here, and others rely on artificial urgency. The attacker must be prepared to handle questions, maintain persona consistency, and maneuver around natural skepticism.

The operational question is what happens when the target asks a verification question.

Consider a help desk call, the highest-yield path in current enterprise attacks. The Scattered Spider campaigns against MGM Resorts and Caesars Entertainment in Sep 2023 used this attack vector. They used LinkedIn to identify an active MGM employee, called the help desk, impersonating them, and gained administrator privileges to Okta and Azure in a ten-minute call. The group ran the same kind of call against several victims, which shows these operations are rehearsed against predictable verification scripts. Caesars paid a $15 million ransom, while MGM took an estimated $100 million hit to its 2023 third-quarter results.

When a question catches the attacker unprepared, they usually fall back on one of these moves:

1. Deflection (“I’m on my mobile, away from my desk”) pushes the verification burden back onto the rep.
2. Authority redirection (“Your manager, Monica, told me to call this number”) uses a real, findable name.
3. Urgency escalation (“The CFO is waiting on this”) exploits a structural reality, call resolution times, that help desks are measured on. This works against thorough verification.
4. Graceful withdrawal is the failsafe. If a rep is too rigorous, the attacker ends the call and dials again.

Phase 3: Exploitation

Exploitation happens when a target shares credentials, approves a transfer, clicks a malicious link, or downloads a document. The exploit itself may take seconds, but every earlier phase was built to get the target here.

Phase 4: Execution and Exit

Once sensitive information or system access has been obtained, the attacker executes their primary objective: consolidation. The first thing an attacker does after lateral movement through a network is to convert those working credentials into persistent access that can help them exfiltrate what is valuable and exit before detection.

Manipulation Signals Your Security Team Should Monitor For

Social engineering attacks share a recognizable pattern of psychological triggers. Training people to spot them is one of the fastest ways to cut your risk.

• Artificial urgency is the most consistent signal. Any request that compresses decision time (an immediate wire transfer, an urgent credential reset, or a time-sensitive approval) is designed to stop the target from thinking critically. Legitimate requests from colleagues, vendors, and executives can almost always wait for verification.
• When an identity claim cannot be independently verified, companies should treat any request for an action involving sensitive access or financial movement as a red flag.
• Polished, contextually accurate language is no longer a signal of credibility. AI has made grammatically flawless, personally relevant impersonation cheap. A well-written email with accurate internal context may be more dangerous than a poorly written one, because it is designed to pass the instinctive credibility check your employees perform.
• Requests for urgent action via collaboration tools such as a colleague’s Slack account should be verified the same way an email from an unknown external sender would be.
• Voice and video requests involving sensitive actions require second-channel verification. Voice cloning and deepfake technology have made audio and video unreliable as identity proof in isolation.

How to Detect Social Engineering Attacks: Seven Operational Priorities To Defend Yourself

Security awareness training and technology both matter, but neither works unless verification is built into the processes attackers target most.

1. All wire transfers, credential resets, access changes, and every request that arrives via email, SMS, Slack, or phone must be confirmed through a separate, pre-established contact method before action is taken. Inline payment verification platforms (Trustpair, Eftsure) and workflow tools that build verification gates in procurement systems (ServiceNow approval automation and Kyriba payment controls) operationalize this without slowing legitimate transactions. This is the single most effective control against BEC and help desk impersonation attacks.
2. Pressure to act immediately, regardless of the source or channel, should be treated as a red flag and is grounds for a verification pause. Your company should build this into its policy so that employees are empowered to slow down without penalty. AI-native behavioral email security platforms (Abnormal Security, Tessian, IRONSCALES) detect urgency-language patterns, anomalous sender-recipient combinations, and pretexting markers that legacy secure email gateways miss, flagging suspect messages before they land in the inbox.
3. Smishing, vishing, impersonation of collaboration platforms, and quishing are not covered by email security training. Your training program needs to account for the full attack surface your employees face. Multi-channel security awareness platforms like Hoxhunt and Cofense PhishMe now run vishing call campaigns, smishing tests, QR-based phishing exercises, and Teams/Slack impersonation simulations against your workforce, generating per-channel susceptibility metrics that your CISO can track quarterly against an industry baseline.
4. An attacker’s most reliable path into your organization may be a single convincing phone call to your IT support line. Credential resets and access changes should require identity verification via a separate, secure protocol, such as cryptographic or biometric channels, to avoid reliance on data that has already leaked.
5. Zero Trust architecture assumes no implicit trust within the network perimeter. Companies must apply the same logic to human interactions: no request for a sensitive action is trusted by default, regardless of the requester’s apparent identity. Identity Threat Detection and Response (ITDR) platforms (Silverfort, Push Security, Permiso) extend this principle to the identity layer itself, flagging anomalous authentication patterns, OAuth grant abuse, and lateral movement performed through legitimate credentials.
6. Your leadership team needs to understand that audio and video are no longer reliable identity proof in isolation. A call from what sounds like your CEO requesting an urgent transfer is not sufficient authorization. Therefore, real-time deepfake detection has emerged as a distinct platform category, encompassing voice-channel detection for contact centers and executive lines, as well as synthetic video detection for Zoom, Teams, and conferencing platforms.
7. Repeated authentication prompts to one account within a short window point to MFA fatigue or prompt bombing. Microsoft’s 2025 Digital Defense report found that 80% of MFA-bypass breaches use AiTM session token theft instead of a direct credential compromise. While neither pattern can be detected with rule-based authentication systems alone, behavioral analytics tools like Exabeam, Securonix, and Microsoft Sentinel UEBA, deployed alongside ITDR platforms, set a baseline and flag deviations in real time, including the specific signal patterns that precede session-token theft.

Precision targeting: who is at risk?

Modern social engineering attacks are precision operations instead of wide nets, and certain roles carry far more risk than others.

Finance teams are usually the primary targets of wire fraud and invoice manipulation attacks. The FBI IC3 2025 Report logged US$3.05 billion in business email compromise (BEC) losses, making it the most financially damaging social engineering category tracked by the bureau. A single approved transaction is all it takes. BEC campaigns target finance staff impersonating executives or vendors, specifically because the conversion from deception to financial loss requires only one person to say yes.

Help desk and IT staff are targeted through pretexting and impersonation to perform credential resets, grant new account access, or elevate system privileges. The attacker does not need to crack your authentication system if they can simply convince your help desk to reset the password over the phone.

Executives are both direct targets and impersonation assets. Attackers target them for direct financial approvals and deepfake them to extract money from others. Two recent incidents show the range of outcomes.

• In Apr 2025, attackers used a help-desk vishing technique to call Marks & Spencer’s service desk, run by Tata Consultancy Services. They successfully exfiltrated the core Active Directory database, which stored password hashes for every domain user in M&S’s network, and then deployed DragonForce ransomware across the network. The combined loss for M&S ranged from $363 million to $592 million.
• In Jul 2024, a Ferrari executive received a voice-clone call on WhatsApp posing as a follow-up from the CEO and noticed subtle mechanical inconsistencies in the caller’s intonation when asked a personal, context-based question. The company lost neither money nor data thanks to the executive’s quick thinking.

Third-party vendors and partners present an indirect attack surface. Trusted relationships between your organization and your vendor network give attackers a strong, established foothold in those external accounts if they can compromise or impersonate them.

Any role with access, authority, or trust is a potential entry point, and in a large enterprise that covers more of the workforce than most security teams track.

How AI is accelerating social engineering

AI-enabled attacks have widened the gap between what attackers can do and what enterprise defenses can catch.

The IBM 2025 Cost of a Data Breach Report noted that 1 in 6 breaches now involve attackers using AI, with AI-generated phishing accounting for 37% of those AI-assisted incidents. Attacks that once took time and money to hand-craft are now routine for most threat actors.

Voice-cloning applications can replicate an executive’s tone and cadence from a few minutes of recorded audio. AI chatbots can sustain a convincing real-time conversation posing as IT support or a financial representative. The old giveaways in a phishing message or a cloned voice, like awkward phrasing, generic language, and spelling errors, are gone.

Collaboration platforms have become a major attack vector that few teams are ready for. When an attacker has compromised a legitimate internal account, impersonation on Slack, Microsoft Teams, and similar tools carries an inherent credibility that email-based attacks do not. While your employees are trained to be skeptical of unexpected emails, they are rarely trained to verify urgent Slack messages from colleagues.

For a deeper look at how generative AI is reshaping these tactics end to end, see our guide on AI social engineering.

Why social engineering will stay the dominant attack path

The technology deployed against your organization will continue to improve. The psychological levers that make social engineering so effective (urgency, authority, trust, and familiarity) will not change, because they are not software vulnerabilities. They are features of human decision-making.

AI has cut the cost of precision. Attackers can now run targeted, personalized campaigns at scale that used to take real time and expertise, so your attack surface is broader than it was two years ago and gets worked harder, at lower cost, with fewer detectable tells.

The organizations best placed to handle this are the ones that have built verification-first cultures, trained their employees to treat urgency as a manipulation signal, and deployed security tools to detect behavioral patterns that are otherwise difficult to pinpoint.

Protect your trust layer with Diopter

At Diopter, we work with organizations that understand the threat is no longer primarily technical. Social engineering succeeds because it exploits gaps between your employees, processes, and detection capabilities. Modern AI has made those gaps harder to see in real time.

Diopter’s platform is built to give your security teams the intelligence and detection capabilities they need to identify and respond faster to social engineering campaigns before they break your team’s trust.

If your security program treats human manipulation only as a training problem, it’s missing the detection side.

FAQs