What Is Social Engineering? Tactics and Defenses
Social engineering is the art of manipulating people into giving up information or access, rather than breaking through technical defenses. Instead of exploiting a software bug, the attacker exploits trust, helpfulness, fear, or curiosity.
Because it targets human psychology, no firewall fully stops it. Awareness is the defense.
Why social engineering works
Attackers rely on predictable human tendencies: we want to be helpful, we respect authority, we react to urgency, and we are curious. A convincing story that triggers one of these instincts can bypass even strong technical controls.
Common tactics
Social engineering shows up in many forms:
- Pretexting: inventing a believable scenario ("I am from IT and need to verify your login").
- Baiting: leaving malware on a USB drive or offering a tempting free download.
- Tailgating: physically following someone through a secure door.
- Quid pro quo: offering a favor or reward in exchange for information or access.
- Business email compromise: impersonating a boss or vendor to authorize a payment.
How to defend against it
These habits break the attacker’s script:
- Verify unexpected requests through a separate, trusted channel.
- Be skeptical of urgency and pressure, slow down.
- Never share passwords or MFA codes, legitimate staff will never ask.
- Follow access rules even when it feels rude (do not hold the door).
- Report anything that feels off, early reporting stops attacks.
How it plays out in the real world
Based on real, widely reported incident patterns; names and details are illustrative.
The help-desk call during the migration
During a well-publicized company migration, an employee got a call: "Hi, it's Devon from IT, we're moving your account tonight. I'm going to send you an approval prompt, just hit Approve so we don't lose your mailbox." Sure enough, an MFA prompt appeared on her phone.
The prompt was real, because the caller was logging in with her phished password at that exact moment. Her Approve completed the attacker's login. The caller's confidence, the timing, and the genuine prompt made it feel completely legitimate.
- Context is the con. Attackers time their calls to real events, migrations, outages, onboarding, so the request feels expected. The legitimacy of the moment is not the legitimacy of the caller.
- Never approve an MFA prompt you did not initiate. An unexpected prompt means someone has your password and is logging in right now. Deny it and change your password immediately.
- Verify people through a channel you chose. Hang up and call IT on the published number. Real IT staff are never offended by verification; impostors always are.
Test yourself
Practice spotting manipulation with a free quiz.
Frequently asked questions
What is the difference between phishing and social engineering?
Phishing is one type of social engineering, specifically, deceptive messages. Social engineering is the broader category that also includes phone calls, in-person tricks, and physical tactics like tailgating.
Can technology stop social engineering?
Tools like email filtering and MFA help, but because social engineering targets people, awareness and healthy skepticism are the most important defenses.
What should I do if I think I was targeted?
Stop the interaction, do not share anything further, and report it to your security team. If you already shared credentials, change them and enable MFA immediately.