Social engineering
Manipulate a person’s decision rather than only exploiting software.
The idea
Social engineering uses influence, deception, or pressure to obtain access or information. Common pretexts invoke authority, urgency, helpfulness, or fear of a missed opportunity. Defenses should support people with reliable verification procedures, clear reporting channels, and permission to pause suspicious requests. Blaming the person who reported a mistake discourages early detection. Design processes so a convincing story alone cannot authorize a sensitive action.
In practice
A caller claims to be an executive and requests an emergency bank-account change. The finance team follows a previously established callback and approval process.
A common misunderstanding
Awareness training is not a substitute for process controls. Even knowledgeable people can face pressure or fatigue.
Check your understanding
What makes a verification process effective?
Think it through: It uses a trusted independent channel and cannot be bypassed solely because the requester claims urgency.
A request can exploit an ordinary workflow
Social engineering manipulates decisions through a believable story or interaction. The channel can be email, messaging, a phone call, a website, or in-person contact. The request may seek credentials, payment, confidential information, or a change to a process. Technical polish and familiar details can make deception convincing even when obvious spelling mistakes are absent.
Reliable verification should use an independent, established route. Calling a number supplied in the suspicious message simply continues the same untrusted interaction. For sensitive changes, a known contact method and an approved workflow help staff pause without feeling that they are obstructing legitimate work.
A fictional urgent supplier change
An academy's finance team receives a message claiming that a supplier's payment details must change immediately. The request uses real project context and appears to come from a familiar person. Staff follow the established verification process using previously recorded contact information rather than replying within the message. The outcome is documented through the normal approval route.
The lesson is not that staff must identify every deception unaided. Design processes so a single persuasive message cannot authorize a high-impact action. Combine role-based approval, technical email protections, authentication, and an accessible reporting channel. People should be able to report a mistake quickly without expecting humiliation.
Rewrite the workflow
Create a fictional request to reset an administrator's access. Define the official verification steps, who can approve the action, and where evidence belongs. Then add an urgent caller and explain how the process remains usable without abandoning its checks. Use a paper scenario rather than deceiving real colleagues.
Measure whether the workflow helps people make and report decisions, not only whether they click a simulated link. A low click count can hide unreported mistakes, while timely reporting can limit harm after a convincing attack reaches someone. Security improves when human support and technical boundaries reinforce each other.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: An Introduction to Information SecurityUK NCSC: Phishing attacks—defending your organisation