Social engineering attacks use deception and psychological manipulation to persuade people to reveal sensitive information, transfer money, open malicious files, or grant unauthorized access. Rather than relying only on technical vulnerabilities, attackers exploit trust, fear, curiosity, urgency, authority, and the desire to help.

Common forms include phishing emails, fraudulent phone calls, text-message scams, executive impersonation, business email compromise, and AI-generated voice or video impersonation. These attacks can affect individuals, businesses, government agencies, healthcare providers, educational institutions, and cryptocurrency users.

The strongest defense combines security awareness with independent verification, multifactor authentication (MFA), strong access controls, and a clear process for reporting suspicious activity. Because social engineering often abuses legitimate business workflows, verification should be built into payment, account-recovery, access, and data-sharing processes rather than left to individual judgment alone.

What Is a Social Engineering Attack?

A social engineering attack is an attempt to manipulate someone into taking an action that compromises security. An attacker may impersonate a trusted person, invent an emergency, offer a tempting reward, or create a convincing fake website to obtain credentials, money, confidential information, or system access.

Unlike a conventional technical attack that directly exploits a software vulnerability, social engineering often persuades the victim to perform the action that enables the compromise. For example, an employee may receive an email that appears to come from the company’s finance director and requests an urgent payment to a new supplier account. If the employee follows the instructions without independently verifying the request, the organization could lose money even if its systems are otherwise secure.

Key characteristics of social engineering

• Trust exploitation: The attacker impersonates someone the victim recognizes or respects.
• Urgency: The message pressures the victim to act before checking the facts.
• Fear: The attacker threatens account suspension, legal consequences, or financial loss.
• Curiosity: A message or attachment promises interesting, confidential, or unexpected information.
• Authority: The attacker claims to represent management, technical support, a bank, or a government agency.
• Manipulated incentives: The victim is offered money, assistance, access, or a reward in exchange for cooperation.

Social engineering can be used to steal credentials, commit financial fraud, install malware, facilitate ransomware attacks, or obtain confidential business information.

10 Examples of Social Engineering Attacks

The following examples describe how common techniques work, how to recognize them, and how to respond safely.

1. Phishing Emails

Phishing is a social engineering technique in which attackers send deceptive emails or messages that appear to come from legitimate organizations. Their aim is to make recipients click malicious links, disclose login credentials, download harmful attachments, or submit payment information.

For example, an employee may receive an email claiming that the company’s email account will be deactivated unless the employee verifies a password immediately. The message includes a link to a fake login page that copies the company’s branding. Once credentials are entered, the attacker may capture them and attempt to access the real account.

Warning signs include unexpected requests to verify passwords or payment details, sender addresses that imitate but do not match legitimate domains, links leading to unfamiliar or misspelled domains, unexpected attachments, requests to enable macros, and messages that create pressure or threaten immediate consequences.

To reduce the risk, verify requests through a trusted channel, navigate directly to official websites instead of using unsolicited links, and report suspicious messages to the appropriate security team. MFA and phishing-resistant authentication can further reduce the risk of account compromise.

2. Spear Phishing and Whaling

Spear phishing is a targeted phishing attack tailored to a particular individual or organization. Whaling is a form of targeted phishing aimed at senior executives or other high-value individuals.

Attackers may research job titles, business relationships, public announcements, and social media profiles to make their messages more convincing. A finance manager, for example, might receive an email that appears to come from the chief financial officer. The email could refer to a recent company acquisition and ask the manager to review a supposedly confidential document. The document may lead to a fraudulent login page, or the message may seek sensitive information directly.

Warning signs include unexpected requests involving confidential documents, messages that reference genuine projects but request unusual actions, demands to bypass standard approval processes, and unusual instructions from senior leaders even when the writing style appears authentic.

Unusual requests should be verified independently, particularly when they involve credentials, confidential data, or payments. Organizations should use approval workflows, role-based access controls, and targeted security training for employees with financial or administrative privileges.

3. Smishing: Fraudulent Text Messages

Smishing is phishing conducted through SMS or other text-messaging channels. Attackers may impersonate delivery companies, banks, government agencies, online marketplaces, or account-support teams.

In one common scenario, a person receives a text claiming that a parcel cannot be delivered until a small fee is paid. The link leads to a fake payment page that collects card details and personal information. Other messages claim that a bank account has been locked or that a suspicious transaction requires immediate confirmation.

Warning signs include unexpected delivery or account-security alerts, shortened or unfamiliar links, requests for passwords, payment-card details, or one-time passcodes, and threats that an account will be blocked unless the recipient acts immediately.

Do not follow unexpected payment links. Check delivery or account information through the provider’s official app or website. If a message claims to come from a bank, contact the bank using a verified telephone number.

4. Vishing: Voice Phishing and Phone Scams

Vishing uses telephone calls or voice messages to persuade victims to disclose sensitive information, authorize payments, or grant access to an account. Attackers may pretend to be bank employees, government officials, technical-support agents, or company executives. Some use caller-ID spoofing so that a call appears to originate from a legitimate organization.

For example, a caller may claim to work for a bank’s fraud department and say that the recipient’s account is under attack. The caller requests a one-time passcode to stop the transaction. If the victim shares the code, the attacker may use it to authorize account access or a transaction.

Warning signs include requests for passwords, one-time passcodes, or recovery codes; pressure to transfer money to a supposedly safe account; instructions to install remote-access software; threats; demands for secrecy; or requests to bypass normal procedures.

End unexpected calls that request sensitive information and contact the organization independently using its official contact details. Never share authentication codes with callers or approve a login that you did not initiate.

5. Pretexting and Impersonation

Pretexting occurs when an attacker invents a believable identity or situation to persuade someone to provide information or perform an action. Impersonation is a common way to establish that false identity. The attacker may pose as an IT technician, supplier, auditor, colleague, recruiter, or customer.

For example, someone may contact an employee while claiming to be part of the internal IT team. The caller says that a system migration is underway and asks the employee to confirm login details. The story sounds plausible because the organization is genuinely carrying out technical maintenance, but the caller’s identity has not been verified.

Warning signs include requests for information outside the requester’s normal responsibilities, refusal to follow standard identity checks, a familiar name paired with an unfamiliar phone number or email address, and requests for confidential information under the pretext of an audit or emergency.

Confirm identities through an independently obtained contact method. Follow documented procedures for account recovery, technical support, and access requests. Employees should be encouraged to question unusual requests without fear of criticism.

6. Business Email Compromise (BEC)

Business email compromise is a form of fraud in which attackers use compromised email accounts or convincing impersonation to manipulate business payments or obtain sensitive information. BEC attacks frequently target finance teams, executives, suppliers, and employees responsible for payroll or accounts payable.

The FBI’s Internet Crime Complaint Center reported approximately $55.5 billion in exposed losses associated with reported BEC incidents worldwide from October 2013 through December 2023. This is a cumulative figure based on complaints, not an estimate of annual losses or proof that every incident involved the same technique.

A typical example involves an accounts-payable employee receiving an email that appears to come from a regular supplier. The message says that the supplier has changed its bank account and instructs the employee to send the next payment to the new account. The email may have been sent from a compromised supplier account, making the request particularly difficult to distinguish from legitimate correspondence.

Warning signs include changes to supplier bank details, unexpected requests for urgent or confidential transfers, slight alterations in an email address or domain, and requests to keep transactions secret or avoid normal approvals.

Verify payment-detail changes through a previously established telephone number or another trusted channel. Require independent approval for high-value transfers, use dual authorization, and review payment anomalies. Email authentication technologies such as SPF, DKIM, and DMARC can help protect against certain forms of email spoofing, but they do not eliminate impersonation or compromised-account risks.

7. Baiting and Malicious USB Devices

Baiting exploits curiosity, financial incentives, or the desire to obtain something useful. Attackers may offer fake downloads, free software, prizes, or physical devices that lead to malware infection or information theft.

For example, someone may find a USB drive labeled “Confidential Payroll” in an office parking area and connect it to a work computer out of curiosity. If the device contains malicious files or exploits a device vulnerability, it could expose the computer or organizational network to risk.

Warning signs include unsolicited USB drives or storage devices, downloads advertised as free premium software, unexpected files that require unusual permissions, and offers that require security protections to be disabled.

Never connect unknown storage devices to work or personal computers. Use approved software sources, endpoint protection, application controls, and policies that restrict unapproved removable media.

8. Tailgating and Physical Social Engineering

Tailgating occurs when an unauthorized person enters a restricted area by following an authorized individual through a secured entrance. The attacker may pretend to be a delivery worker, contractor, visitor, or colleague who has forgotten an access badge.

An individual carrying several boxes, for example, may approach an employee entering a secure office and ask the employee to hold the door open because the individual’s hands are full. If the employee allows the person inside without checking authorization, the attacker may gain access to offices, devices, documents, or network equipment.

Warning signs include people asking to bypass badge checks, visitors who cannot provide valid identification, unescorted individuals in restricted areas, and requests to ignore physical-security procedures out of politeness.

Every person should use the appropriate access-control process. Employees should politely direct visitors to reception rather than allowing unverified entry. Organizations can strengthen protection through visitor logs, access badges, security staff, and anti-tailgating controls.

9. Watering Hole Attacks

A watering hole attack compromises a website or online resource that members of a particular target group are likely to visit. The objective is to reach victims through a site they already trust. Unlike a conventional phishing attack, the attacker may not need to send the victim a direct message.

For example, attackers may compromise a website frequently used by professionals in a particular industry. Visitors could encounter malicious content that attempts to exploit browser vulnerabilities or redirect them to fraudulent pages. A successful attack could expose sensitive information or provide a route to further compromise.

Warning signs include unexpected redirects from familiar websites, security warnings or unusual browser behavior, requests to install unfamiliar software or browser extensions, and unexplained downloads from websites that normally require none.

Keep browsers, operating systems, and security tools updated. Use reputable endpoint protection, restrict unnecessary browser privileges, and investigate unexpected downloads or redirects. Website owners should maintain their software, monitor for unauthorized changes, and promptly address security vulnerabilities.

10. AI-Generated Impersonation and Deepfakes

Artificial intelligence can help attackers create convincing messages, synthetic voices, altered images, and realistic video impersonations. These tools can make social engineering more persuasive, particularly when combined with information collected from public sources.

AI-assisted attacks can overlap with phishing, vishing, spear phishing, and business email compromise. AI is a tool that can strengthen these existing techniques rather than a completely separate category of attack.

In one example, an employee receives a video call that appears to show a senior executive requesting an urgent financial transfer. The caller sounds familiar and refers to genuine company projects. The employee assumes the request is authentic and begins the transfer without following the normal approval process.

Warning signs include unusual financial requests made during unexpected calls, pressure to bypass normal payment procedures, refusal to verify identity through a separate channel, and unexpected changes in communication patterns even when the voice or video seems genuine.

Use established identity-verification and payment-approval procedures. Verify unusual requests through a separate, trusted channel and use agreed internal verification methods for high-risk transactions. Do not rely exclusively on visual glitches, unnatural speech, or other supposed deepfake clues. Synthetic media can be convincing, and legitimate recordings can also look or sound unusual.

Real-World Social Engineering and Cyberattack Cases

Documented incidents show why organizations must protect both their technology and the people who use it. However, not every major breach is a confirmed social engineering incident. That distinction matters when evaluating what happened and what lessons can reasonably be drawn.

Target Corporation: The 2013 Data Breach

In December 2013, Target disclosed unauthorized access that affected approximately 40 million credit and debit card accounts. The company later reported that information associated with up to 70 million individuals was also stolen. Investigations documented malware on point-of-sale systems.

The incident is frequently discussed in connection with third-party security and supply-chain risk. However, the presence of a vendor relationship does not mean every detail of the initial compromise should be described as a confirmed social engineering technique.

The security lesson is that organizations should limit third-party access, monitor vendor connections, segment sensitive systems, and investigate suspicious activity across their networks.

Sony Pictures Entertainment: The 2014 Cyberattack

In November 2014, Sony Pictures Entertainment suffered a major cyberattack involving destructive malware and the theft of proprietary information, employee personal information, and confidential communications. The FBI publicly reported findings from its investigation in December 2014.

The incident illustrates how a cyberattack can affect business operations, confidential communications, employee privacy, and intellectual property. Organizations should maintain tested backups, restrict privileged access, monitor networks, develop incident-response plans, and prepare for the operational consequences of a serious breach.

Business Email Compromise: Documented Financial Losses

Business email compromise is another well-documented threat. The FBI has reported substantial cumulative losses associated with BEC complaints, reflecting the ability of impersonation and fraudulent payment instructions to cause significant financial damage.

The defining risk is not simply that a fraudulent email looks convincing. It is that the recipient may have the authority to move money, change supplier details, or disclose sensitive information.

Payment instructions should be verified independently, payment initiation should be separated from approval, and organizations should establish clear procedures for responding to unusual financial requests.

What These Incidents Have in Common

Several practical lessons emerge across these cases:

• Technical controls must be supported by sound operational procedures.
• Third-party access should be limited to what is necessary.
• Employees need a simple way to report suspicious activity.
• Financial and privileged actions should require appropriate verification.
• Incident-response plans should be tested before an attack occurs.

These lessons are more useful than assuming every major breach happened through the same psychological trick.

Why Do Social Engineering Attacks Work?

Social engineering succeeds when an attacker influences a person’s decision-making before the person verifies the request. Several psychological factors make these attacks effective:

• Authority bias: People may comply with someone who claims to be a manager, police officer, or IT specialist.
• Urgency: Time pressure reduces the opportunity to check whether a request is legitimate.
• Fear: Threats involving money, employment, legal consequences, or account suspension can trigger impulsive action.
• Curiosity: Unexpected files, sensational claims, and tempting offers encourage people to click.
• Trust and familiarity: Attackers imitate colleagues, suppliers, friends, or family members.
• Reciprocity: Someone who offers assistance or a reward may expect something in return.
• Routine and distraction: Busy employees may approve requests without applying normal checks.

These factors are not evidence that victims are careless or unintelligent. Social engineering is designed to exploit ordinary human behavior, including the natural tendency to trust familiar people and respond to urgent situations. Effective prevention makes safe decisions easier by building verification into everyday processes.

How to Prevent Social Engineering Attacks

The best defense combines individual awareness with organizational security controls. Training is important, but employees should not be expected to detect every sophisticated impersonation attempt on their own.

For Individuals

• Verify unexpected requests. Contact the sender through a known phone number, official app, or independently verified email address.
• Avoid suspicious links and attachments. Navigate directly to the official website when checking an account or service.
• Never disclose authentication codes. Do not share one-time passwords, recovery codes, or passwords with unexpected callers or message senders.
• Enable multifactor authentication. Prefer phishing-resistant methods, such as passkeys or hardware security keys, when available.
• Use unique passwords. A reputable password manager can help generate and store different passwords for each service.
• Keep software updated. Install security updates for operating systems, browsers, applications, and mobile devices.
• Limit public personal information. Avoid sharing information that could make impersonation or targeted phishing easier.
• Report suspicious messages. Use the relevant platform’s reporting function or contact the organization being impersonated.

For Organizations

Organizations should combine technical safeguards, clear procedures, and regular employee education. Security exercises should be designed to improve resilience, not shame employees.

Organizations should measure reporting rates, response times, recurring weaknesses, and the effectiveness of corrective actions rather than relying solely on click rates. For a broader risk-management framework, consult the NIST Cybersecurity Framework and CISA’s phishing recognition and reporting guidance.

What to Do If You Fall for a Social Engineering Scam

If you clicked a suspicious link, shared sensitive information, installed unexpected software, or transferred money, act promptly. The appropriate response depends on what was exposed.

1. Secure affected accounts. From a trusted device, change compromised passwords, revoke active sessions where possible, and reset exposed recovery credentials. Secure the email account first if it can be used to reset other passwords.

2. Contact your bank or payment provider. If money or payment information is involved, report the incident immediately. Request a transfer recall, payment block, or card replacement where appropriate. Recovery is not guaranteed, so speed matters.

3. Report the incident. Notify your organization’s IT or security team, the impersonated service, or the relevant national cybercrime reporting authority. Preserve suspicious messages and transaction records.

4. Check affected devices. If you installed software or opened a suspicious attachment, contact a trusted security professional or your organization’s IT team. Disconnect a potentially compromised device from the network when appropriate, and avoid using it for sensitive transactions until it has been assessed.

5. Monitor for further misuse. Review account activity, financial statements, password-reset alerts, and identity-related notifications. Watch for follow-up scams that exploit information already disclosed.

If the incident involves cryptocurrency, secure the affected exchange account and email account immediately. If wallet recovery phrases or private keys have been exposed, treat the associated wallet as compromised and seek trustworthy, wallet-specific recovery guidance. Blockchain transactions are generally irreversible, and no recovery service can guarantee that stolen funds will be returned.

Social Engineering Statistics and Sources

Statistics can help explain the scale of cybercrime, but only when their definitions, reporting periods, and limitations are clear.

The FBI announced in April 2025 that its 2024 Internet Crime Report included 859,532 complaints of suspected internet crime and more than $16 billion in reported losses, a 33% increase from 2023. These figures cover reported internet crime broadly; they are not a measurement of social engineering losses alone.

Verizon’s 2024 Data Breach Investigations Report found that pretexting featured in more than 40% of the social engineering incidents examined, while phishing featured in 31%. These percentages describe the report’s analyzed incident dataset, not the probability that any individual phishing attempt will succeed.

The FBI’s cumulative BEC figures demonstrate that fraudulent business communications can result in losses across both domestic and international victims. The figures are complaint-based and should not be interpreted as a complete accounting of all worldwide incidents.

When evaluating a social engineering statistic, ask what year or reporting period it covers, whether it measures attacks, attempted attacks, incidents, confirmed breaches, complaints, or financial losses, whether it is global or limited to a particular country or industry, whether the source reports observations or makes a forecast, and what limitations the source discloses.

Incident counts, attack success rates, breach costs, and reported fraud losses should not be combined into a single comparison. These measurements describe different things and are not directly interchangeable. For ongoing research, consult the Verizon Data Breach Investigations Report and the FBI IC3 annual reports. Check for newer editions before publishing annual statistics.

Frequently Asked Questions

What is a real-life example of a social engineering attack?

A common example is a fraudulent phone call in which someone impersonates a bank employee and asks a customer to disclose a one-time passcode. The attacker may use that code to access an account or authorize a transaction. The safe response is to end the call and contact the bank through an independently verified channel.

What are the most common types of social engineering attacks?

Common types include phishing, spear phishing, smishing, vishing, pretexting, impersonation, business email compromise, baiting, and tailgating. Watering hole attacks and AI-generated impersonation are additional techniques that can be used to reach or deceive specific targets.

What is the difference between phishing and social engineering?

Phishing is one type of social engineering. It typically uses deceptive emails, messages, websites, or other communications to steal information or trigger unsafe actions. Social engineering is the broader category and also includes phone scams, physical impersonation, fraudulent payment requests, and other forms of manipulation.

How do social engineering attacks work?

Attackers research their targets, create a believable story, and exploit trust, urgency, fear, curiosity, or authority. They then persuade the victim to disclose information, click a link, install software, approve access, or transfer money. Verification procedures and security controls can interrupt this process.

Why are social engineering attacks dangerous?

They can bypass some technical safeguards by persuading legitimate users to perform actions with their own access. Consequences can include financial fraud, stolen identities, compromised accounts, data breaches, malware infections, operational disruption, and reputational damage.

How does AI make social engineering attacks more convincing?

AI can help attackers generate personalized messages, imitate writing styles, produce synthetic voices, and create manipulated images or videos. These capabilities can make impersonation more convincing, but they do not guarantee that an attack will succeed. Independent identity checks and established approval processes remain essential.

How can businesses prevent social engineering attacks?

Businesses should combine regular security training with MFA, least-privilege access, email security, independent payment verification, vendor controls, incident-response procedures, and straightforward reporting channels. High-risk requests should require verification independent of the original message.

Are small businesses vulnerable to social engineering?

Yes. Small businesses can be targeted through fake invoices, supplier impersonation, account-takeover attempts, fraudulent technical support, and phishing. Limited security resources can increase exposure, making basic controls such as unique passwords, MFA, payment verification, backups, and employee training especially important.

What should I do if I accidentally clicked a phishing link?

Do not enter additional information or download anything else. If you submitted credentials, change the affected password from a trusted device and revoke active sessions if possible. If you installed software, seek security assistance. Report the message and monitor affected accounts for suspicious activity.

How can I recognize a business email compromise scam?

Look for unexpected payment instructions, supplier bank-account changes, unusual requests from executives, and pressure to bypass established procedures. Email addresses and writing styles can be imitated, so verify financial instructions using a trusted, separate communication channel.

What role does social media play in social engineering?

Public profiles can reveal job roles, personal interests, business relationships, travel plans, and organizational details. Attackers may use this information to create believable impersonation attempts. Limit unnecessary public disclosures and verify unexpected requests, even when they refer to genuine personal or professional details.

Can multifactor authentication prevent social engineering attacks?

MFA can reduce the risk of account takeover when a password is stolen, but it does not stop every social engineering attack. Attackers may attempt to trick victims into approving fraudulent login requests or disclosing authentication codes. Phishing-resistant authentication, such as passkeys or security keys, offers stronger protection against many credential-phishing techniques.

Conclusion

Social engineering attacks exploit human trust and decision-making to gain access to information, accounts, systems, or money. Phishing emails, fraudulent phone calls, impersonation, business email compromise, physical intrusion, and AI-generated deception are different methods, but they share the same underlying objective: persuading a target to take an unsafe action.

The strongest defense combines human awareness with practical safeguards. Individuals should verify unexpected requests, protect authentication credentials, and report suspicious activity. Organizations should enforce payment controls, limit access, secure their systems, and make it easy for employees to question unusual instructions.

Real-world cyber incidents demonstrate why neither technology nor training is sufficient on its own. A resilient security strategy treats people, processes, third parties, and technology as connected parts of the same defense.

Source: Cryptsy. Written by Ethan Blackburn.