What Is Social Engineering? Tactics, Examples and Defenses
How social engineering works, the main tactics from phishing to tailgating, and ready-to-use role-play scenarios to train your team.
Social engineering is manipulating people, rather than hacking systems, to get money, access or information. Attackers impersonate someone trusted, create urgency and ask for a payment, password or door to be held open. Common tactics are phishing, vishing, pretexting, baiting and tailgating. The best defenses are verification rules, MFA and regular role-play training.
Photo: Unsplash
On this page
Most attacks on small businesses don’t start with clever code. They start with a message or a phone call that sounds routine: a vendor with new bank details, the CEO needing gift cards before a meeting, an IT technician who needs your login to “fix” a problem. The attacker never breaks through a firewall. Someone simply lets them in.
That is social engineering. It works because it targets helpfulness, trust and the pressure to get things done quickly. It is also the reason a business with good software can still lose money in an afternoon.
This guide explains what social engineering is, the main tactics to watch for and the defenses that actually work. It ends with role-play scenarios you can run with your team in 15 minutes.
What social engineering means
CISA describes social engineering as an attack that uses human interaction and social skills to obtain or compromise information about an organization. In plain terms, the attacker manipulates a person into doing something they shouldn’t: sharing a password, approving a payment, opening a file or holding a door.
Every social engineering attack follows a similar pattern:
- Research. The attacker learns names, roles, vendors and routines from your website, LinkedIn, social media or earlier breaches.
- Pretext. They pick a believable identity: a supplier, a manager, IT support, a delivery driver, a bank.
- Pressure. They add urgency, authority or fear so the target acts before thinking.
- Payoff. Money moves, credentials are typed into a fake page, malware runs or someone gets into the building.
The scale is large. In the FBI’s 2025 Internet Crime Report, business email compromise, a social engineering scheme aimed at businesses, accounted for about $3.05 billion in reported losses, second only to investment fraud. Tech support and government impersonation scams, both built on social engineering, added billions more.
The main social engineering tactics
Phishing, smishing and vishing
Phishing uses email or fake websites to trick people into revealing information or clicking malicious links. Smishing does the same over text message, and vishing uses phone calls, often with a spoofed caller ID. CISA notes that attackers often borrow current events, holidays and health or money worries to make messages feel timely. Our guide on how to spot phishing emails covers the red flags in detail.
Pretexting
Pretexting means building a false story to justify a request. The attacker might pose as an auditor who needs an employee list, a new hire who can’t access a system or a vendor’s accounts team updating payment details. Pretexting is the engine behind business email compromise, where a convincing email from a “supplier” or “executive” redirects a wire or ACH payment.
Baiting
Baiting offers something tempting, such as a free download, a gift card or a USB drive labeled “Payroll Q4” left in the parking lot. Curiosity does the rest. Plugging in the drive or downloading the file installs malware or leads to a credential-stealing page.
Tailgating and piggybacking
Tailgating is the physical version: someone follows an employee through a secure door without badging in. Piggybacking is when the employee knowingly holds the door, often because the visitor is carrying boxes or claims to have forgotten their badge. Once inside, the intruder can plug into the network, photograph screens or take devices.
Quid pro quo
The attacker offers help in exchange for access. A classic version is a caller claiming to be IT support who “fixes” a made-up problem in return for your password or remote access to your computer.
Impersonation with AI
Generative AI makes impersonation cheaper and more convincing. The FBI’s 2025 report says chat tools can quickly produce official-sounding emails mimicking a company’s CEO, and voice cloning can be used to request wire payments. It also describes voice spoofing and possible deepfakes in online job interviews. See our guide on how to spot a deepfake.
| Tactic | Channel | What the attacker wants | Best single defense |
|---|---|---|---|
| Phishing | Email, fake websites | Passwords, malware install | Phishing-resistant MFA plus reporting button |
| Smishing | Text messages | Logins, payment details | Never act on links in unexpected texts |
| Vishing | Phone calls | Passwords, payments, remote access | Hang up and call back on a known number |
| Pretexting | Email, phone, in person | Payment changes, data, access | Out-of-band verification for any change |
| Baiting | USB drives, free downloads | Malware on your network | Block unknown USB devices; download policy |
| Tailgating | Physical entry | Building and network access | Badge-in rule for everyone, every time |
| Quid pro quo | Phone, chat | Remote access, credentials | IT never asks for your password |
| Deepfake voice or video | Calls, video meetings | Urgent payments, hiring access | Code word or callback for money requests |
Key takeaway: Social engineering beats technology by targeting people’s helpfulness and fear of saying no. The fix is to give staff simple verification rules, so following the process is easier than making an exception.
Warning signs to train people on
Most social engineering attempts share a few tells. Teach your team to slow down when they see any of these:
- Urgency: “This must be paid today” or “Your account will be locked in 1 hour.”
- Authority: A request from an executive, regulator, bank or law enforcement agency.
- Secrecy: “Don’t mention this to anyone yet.”
- Channel switching: “Text me on my personal number” or “Let’s move this to WhatsApp.”
- Unusual payment methods: Gift cards, cryptocurrency or a new bank account.
- Requests that skip the normal process: Changing payroll details by email, sharing a one-time code or bypassing badge-in.
- Small inconsistencies: A lookalike domain, a generic greeting or a link that points somewhere other than its text.
Defenses that work for small businesses
Training alone isn’t enough. The strongest programs combine clear rules, technical controls and practice.
Verification rules. Write down a few non-negotiables. Any change to vendor bank details, payroll deposits or wire instructions must be confirmed by calling a known number from your records, never one in the message. Any payment request above a set amount needs 2 people.
Phishing-resistant authentication. Multi-factor authentication stops many stolen-password attacks. Passkeys and hardware security keys go further because they won’t work on a fake website.
Email protections. Set up SPF, DKIM and DMARC so attackers can’t easily spoof your domain. See SPF, DKIM and DMARC explained.
Physical rules. Everyone badges in, every time. Visitors sign in and are escorted. Staff are allowed, and expected, to politely challenge strangers.
A no-blame reporting culture. People must feel safe reporting a click or a suspicious call quickly. Fast reporting turns a breach into a near miss.
Ongoing training. NIST’s SP 800-50 Revision 1, published in September 2024, treats security awareness as a continuing learning program with metrics and regular updates, not a once-a-year video. Our guide to security awareness training for employees covers program options.
Role-play scenarios for your next team meeting
Role-play builds the habit of pausing and verifying. Run 1 or 2 scenarios per meeting. One person plays the attacker, another the employee and the rest watch for red flags. Afterward, ask: what felt pressuring, what was the red flag and what is our rule?
Scenario 1: The vendor bank change (pretexting). An email from a long-time supplier says they have switched banks and asks you to update their details before paying this week’s invoice. The email address looks right. Correct response: Don’t reply to the email. Call the supplier on the number in your vendor file and confirm the change with someone you know.
Scenario 2: The urgent CEO request (impersonation). A text from “the CEO” says they are in a meeting and need 5 gift cards for a client right now. Send the codes by photo. Correct response: Gift cards plus secrecy plus urgency is a scam pattern. Verify through a known channel and report it.
Scenario 3: The helpful IT caller (vishing, quid pro quo). A caller says they are from your IT provider, mentions your manager’s name and says your mailbox has a virus. They need you to read back the code just sent to your phone. Correct response: Never share a one-time code or password. Hang up and call your IT contact directly.
Scenario 4: The delivery at the side door (tailgating). A person in a uniform carrying boxes asks you to hold the secure door because their hands are full. Correct response: Offer to take them to reception or call the person the delivery is for. Don’t let anyone in without a badge or escort.
Scenario 5: The parking-lot USB (baiting). You find a USB drive labeled “Salary review 2026” near the entrance. Correct response: Don’t plug it in. Hand it to IT or whoever manages your systems.
Scenario 6: The voice that sounds right (deepfake). Your finance lead gets a call that sounds exactly like the owner, asking for an urgent wire to close a deal. Correct response: Use a pre-agreed callback or code word for any voice request involving money. Our guide to AI voice cloning scams explains how code words work.
Where to start this month
- List your high-risk processes. Payments, payroll changes, password resets and building access.
- Write 1 verification rule for each. Keep it to a sentence, like “All bank detail changes are confirmed by phone on a known number.”
- Turn on MFA everywhere, starting with email, banking and payroll.
- Add a report button or address for suspicious messages, and thank people who use it.
- Run 2 role-play scenarios at your next team meeting.
- Review quarterly. Add new scenarios based on real attempts your team reports.
If something does get through, follow your incident response plan and report fraud to the FBI’s IC3 at ic3.gov as quickly as possible.
Conclusion
Social engineering will keep working as long as people want to be helpful and fear holding things up. You can’t remove that instinct, and you shouldn’t try. Give people simple rules, back them with MFA and email protections, and practice until checking first is automatic. The goal is a team that treats an urgent, unusual request as a reason to slow down, not speed up.
Sources
- FBI Internet Crime Complaint Center: 2025 IC3 Annual Report — business email compromise losses and AI-enabled impersonation trends
- CISA: Avoiding Social Engineering and Phishing Attacks — definition, phishing, vishing and smishing, defensive tips (archived page)
- CISA: Teach Employees to Avoid Phishing — small business guidance on spotting suspicious requests
- NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program — ongoing awareness and training program guidance (September 2024)
Frequently asked questions
What is social engineering in simple terms?
Social engineering is tricking people into giving up money, access or information instead of hacking computers directly. The attacker pretends to be someone trusted, such as a boss, vendor, bank or IT technician, and pressures the target to act quickly. Phishing emails, scam phone calls and someone talking their way into a building are all forms of social engineering.
What are the most common types of social engineering?
The most common types are phishing by email, smishing by text, vishing by phone, pretexting with a made-up story, baiting with tempting downloads or USB drives, quid pro quo offers of help, and tailgating into secure areas. AI-generated voice and video impersonation is a growing variation. For businesses, pretexting that leads to payment fraud is often the most costly.
What is the difference between phishing and social engineering?
Phishing is one type of social engineering. Social engineering is the broad category of manipulating people, and it can happen by email, phone, text, social media or in person. Phishing specifically uses deceptive emails or fake websites to steal information or install malware. Every phishing attack is social engineering, but not every social engineering attack is phishing.
How do you prevent social engineering attacks?
Prevent social engineering with clear verification rules, technical controls and practice. Require callback verification on known numbers for any payment or bank change, use MFA or passkeys on all accounts, set up SPF, DKIM and DMARC, enforce badge-in rules and run regular training with role-play. A no-blame reporting culture helps you catch attempts early.
What is an example of pretexting?
A common pretexting example is a fake vendor email saying the company has changed banks and asking you to update payment details before the next invoice. Another is a caller posing as an auditor or IT support who needs an employee list or login details. The attacker builds a believable story first, then makes a request that seems reasonable within that story.
Is tailgating a form of social engineering?
Yes. Tailgating is physical social engineering, where an unauthorized person follows an employee through a secured door. It relies on politeness, since most people don't want to shut a door on someone carrying boxes or claiming to work there. A strict rule that everyone badges in individually, plus escorting visitors, is the main defense.
How often should employees get social engineering training?
Employees should get short, regular training rather than a single annual session. NIST's 2024 guidance treats awareness as an ongoing learning program with metrics and updates. Many small businesses combine a brief onboarding session, monthly or quarterly reminders, occasional simulated phishing and role-play scenarios based on real attempts the team has reported.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com