Security Guide · 12 min read
What Is a Social Engineering Attack? A Guide to Detection and Prevention
Social engineering is the art of manipulating people — not systems — into giving up credentials, money, or access. It powers more than 80% of confirmed breaches. This guide breaks down how modern attacks work and how to stop them.
What is a social engineering attack?
A social engineering attack is any technique where an attacker manipulates a person into performing an action or disclosing information that compromises security. Instead of exploiting a software vulnerability, the attacker exploits human trust, urgency, authority, or curiosity. The goal is usually to harvest credentials, install malware, initiate a wire transfer, or bypass multi-factor authentication.
Why social engineering works
Humans are wired to respond to authority, reciprocity, and time pressure. Attackers weaponize these instincts using six recurring levers:
- Authority — impersonating an executive, IT admin, or law-enforcement contact.
- Urgency — "your account will be locked in 10 minutes."
- Fear — invoice past due, legal threat, security alert.
- Curiosity — "someone shared a document with you."
- Reciprocity — a small favor or free gift to build obligation.
- Social proof — "your colleague already approved this."
The 8 most common types of social engineering
1. Phishing
Mass email that spoofs a trusted brand and drives victims to a credential-harvesting page. Modern phishing kits use real-time proxies (AiTM) to defeat legacy MFA.
2. Spear phishing & whaling
Targeted phishing crafted for a specific person, often an executive or finance approver, using OSINT from LinkedIn, press releases, and leaked data.
3. Vishing (voice phishing)
Phone-based attacks. AI voice cloning now lets attackers imitate a CFO or family member with a 10-second audio sample.
4. Smishing (SMS phishing)
Text messages posing as banks, delivery companies, or HR. High click-through because SMS lacks branded sender verification for most users.
5. Pretexting
A fabricated backstory ("I'm from the vendor onboarding team") used to justify a request that would otherwise raise flags.
6. Baiting
Physical or digital lures — USB drops, cracked-software downloads, fake job offers — that deliver malware when opened.
7. MFA fatigue (push bombing)
Attackers with a valid password spam push notifications until the victim taps "Approve" to make them stop.
8. Business Email Compromise (BEC)
Impersonating an executive or supplier to redirect a wire transfer or payroll change. The average BEC loss is over $137,000 per incident.
How to detect a social engineering attempt
- Requests that bypass normal process ("just this once, don't ticket it").
- Mismatched sender domain, display-name spoofing, or lookalike Unicode characters.
- Urgency plus secrecy — "don't loop in anyone else."
- Payment detail changes delivered by email only.
- Unexpected MFA prompts you didn't initiate.
- Links that resolve to a login page one character off from the real domain.
How to prevent social engineering attacks
Technical controls
- Deploy phishing-resistant MFA (FIDO2 / passkeys) — not SMS or push.
- Enforce DMARC, SPF, and DKIM in enforcement mode on every sending domain.
- Block newly registered domains and lookalike domains at the DNS layer.
- Isolate email links in a browser sandbox or remote browser.
- Alert on impossible-travel logins, new OAuth grants, and inbox-rule creation.
Process controls
- Require out-of-band verification for any payment or bank-detail change.
- Dual approval on wire transfers above a defined threshold.
- Standing rule: IT will never ask for a password, MFA code, or approval push.
- Publish a one-click "report phish" button and reward reporters.
People controls
- Run continuous phishing simulations with realistic modern lures — not the "Nigerian prince" era.
- Train finance, HR, and executive assistants separately; they are the highest-value targets.
- Practice tabletop exercises for vishing and deepfake voice scenarios.
What to do if you've been targeted
- Stop interacting immediately — do not reply, click, or approve.
- Report to your security team through the designated channel.
- If credentials were entered: rotate the password and revoke all active sessions and OAuth tokens.
- If a payment was sent: contact your bank within 24 hours to request a SWIFT recall.
- Preserve evidence — full email headers, screenshots, phone numbers, timestamps.
Key takeaway
Social engineering will keep evolving with AI voice cloning, deepfakes, and AI-written spear phishing. The defense is layered: phishing-resistant MFA, verified-out-of-band processes for high-impact actions, and a culture where reporting a suspicious message is faster and safer than complying with it.