Social engineering attacks are deceptive tactics that manipulate people into revealing sensitive information, transferring money, opening malicious files, or granting unauthorized access. Instead of relying solely on technical vulnerabilities, attackers exploit human emotions such as trust, fear, curiosity, urgency, and the desire to help.
Common examples include phishing emails, fraudulent phone calls, text-message scams, executive impersonation, business email compromise, and AI-generated voice impersonation. These attacks can affect individuals, businesses, government agencies, healthcare providers, educational institutions, and cryptocurrency users.
The most effective defense combines employee awareness, independent verification, multifactor authentication (MFA), strong access controls, and a clear process for reporting suspicious activity.
What Is a Social Engineering Attack?
A social engineering attack is an attempt to manipulate someone into taking an action that compromises security. The attacker might impersonate a trusted person, invent an emergency, offer a tempting reward, or create a convincing fake website to obtain credentials, money, confidential information, or system access.
Unlike a conventional technical attack that directly exploits a software vulnerability, social engineering often persuades the victim to perform the action that enables the compromise.
For example, an employee might receive an email that appears to come from the company’s finance director, requesting an urgent payment to a new supplier account. If the employee follows the instructions without independently verifying the request, the organization could lose money even if its systems are otherwise secure.
Key characteristics of social engineering
- Trust exploitation: The attacker impersonates someone the victim recognizes or respects.
- Urgency: The message pressures the victim to act before checking the facts.
- Fear: The attacker threatens account suspension, legal consequences, or financial loss.
- Curiosity: A message or attachment promises interesting, confidential, or unexpected information.
- Authority: The attacker claims to represent management, technical support, a bank, or a government agency.
- Manipulated incentives: The victim is offered money, assistance, access, or a reward in exchange for cooperation.
Social engineering can be used to steal credentials, commit financial fraud, install malware, facilitate ransomware attacks, or obtain confidential business information.
10 Examples of Social Engineering Attacks
The following examples explain how common social engineering techniques work, how to recognize them, and how to respond safely.
1. Phishing Emails
Phishing is a social engineering technique in which attackers send deceptive emails or messages that appear to come from legitimate organizations. Their goal is to make recipients click malicious links, disclose login credentials, download harmful attachments, or submit payment information.
Example: An employee receives an email claiming that their corporate email account will be deactivated unless they verify their password immediately. The message contains a link to a fake login page that copies the company’s branding.
When the employee enters their credentials, the attacker may capture them and attempt to access the real account.
Warning signs:
- Unexpected requests to verify passwords or payment details.
- Sender addresses that imitate, but do not match, legitimate domains.
- Links that lead to unfamiliar or misspelled domains.
- Unexpected attachments or requests to enable macros.
- Messages that create pressure or threaten immediate consequences.
How to prevent it: Verify requests through a trusted channel, navigate directly to official websites instead of using unsolicited links, and report suspicious messages to the appropriate security team. MFA and phishing-resistant authentication can reduce the risk of account compromise.
2. Spear Phishing and Whaling
Spear phishing is a targeted phishing attack tailored to a particular individual or organization. Whaling is a form of targeted phishing that focuses on senior executives or other high-value individuals.
Attackers may research job titles, business relationships, public announcements, and social media profiles to make their messages more convincing.
Example: A finance manager receives an email that appears to come from the chief financial officer. It references a recent company acquisition and asks the manager to review a supposedly confidential document.
The document leads to a fraudulent login page, or the message attempts to persuade the recipient to disclose sensitive information.
Warning signs:
- Unexpected requests involving confidential documents.
- Messages that reference genuine projects but request unusual actions.
- Requests to bypass standard approval processes.
- Unusual instructions from senior leaders, even when the writing style seems authentic.
How to prevent it: Verify unusual requests independently, especially those involving credentials, confidential data, or payments. Organizations should use approval workflows, role-based access controls, and targeted security training for employees with financial or administrative privileges.
3. Smishing: Fraudulent Text Messages
Smishing is phishing conducted through SMS or other text-messaging channels. Attackers impersonate delivery companies, banks, government agencies, online marketplaces, or account-support teams.
Example: A person receives a text message claiming that a parcel cannot be delivered until a small fee is paid. The link leads to a fake payment page that collects card details and personal information.
Other messages claim that a bank account has been locked or that a suspicious transaction requires immediate confirmation.
Warning signs:
- Unexpected delivery or account-security alerts.
- Shortened or unfamiliar links.
- Requests for passwords, payment-card details, or one-time passcodes.
- Threats that an account will be blocked unless the recipient acts immediately.
How to prevent it: Do not follow unexpected payment links. Check delivery or account information through the provider’s official app or website. If a message claims to come from a bank, contact the bank using a verified number.
4. Vishing: Voice Phishing and Phone Scams
Vishing uses telephone calls or voice messages to persuade victims to disclose sensitive information, authorize payments, or grant access to an account.
Attackers may pretend to be bank employees, government officials, technical support agents, or company executives. Some use caller-ID spoofing to make calls appear to originate from a legitimate organization.
Example: A caller claims to work for a bank’s fraud department and says that the recipient’s account is under attack. The caller requests a one-time passcode to stop the transaction.
If the victim shares the code, the attacker may use it to authorize account access or a transaction.
Warning signs:
- Requests for passwords, one-time passcodes, or recovery codes.
- Pressure to transfer money to a supposedly safe account.
- Instructions to install remote-access software.
- Threats, secrecy demands, or requests to bypass normal procedures.
How to prevent it: End unexpected calls that request sensitive information and contact the organization independently using its official contact details. Never share authentication codes with callers or approve a login that you did not initiate.
5. Pretexting and Impersonation
Pretexting occurs when an attacker invents a believable identity or situation to persuade someone to provide information or perform an action. Impersonation is a common technique used to establish that false identity.
The attacker may pose as an IT technician, supplier, auditor, colleague, recruiter, or customer.
Example: Someone contacts an employee claiming to be a member of the internal IT team. The caller says that a system migration is underway and asks the employee to confirm their login details.
The story sounds plausible because the organization is genuinely performing technical maintenance, but the caller’s identity has not been verified.
Warning signs:
- Someone requests information outside their normal responsibilities.
- The requester refuses to follow standard identity checks.
- A familiar name is used with an unfamiliar phone number or email address.
- The person asks for confidential information under the pretext of an audit or emergency.
How to prevent it: Confirm identities using an independently obtained contact method. Follow documented procedures for account recovery, technical support, and access requests. Employees should be encouraged to question unusual requests without fear of criticism.
6. Business Email Compromise (BEC)
Business email compromise is a form of fraud in which attackers use compromised email accounts or convincing impersonation to manipulate business payments or obtain sensitive information.
BEC attacks frequently target finance teams, executives, suppliers, and employees responsible for payroll or accounts payable.
The FBI’s Internet Crime Complaint Center reported approximately $55.5 billion in exposed losses associated with reported BEC incidents worldwide from October 2013 through December 2023. This is a cumulative figure based on complaints, not an estimate of annual losses or proof that every incident involved the same technique.
Example: A company’s accounts-payable employee receives an email that appears to come from a regular supplier. The message says that the supplier has changed its bank account and instructs the employee to send the next payment to the new account.
The email may be sent from a compromised supplier account, making the request particularly difficult to distinguish from legitimate correspondence.
Warning signs:
- Changes to supplier bank details.
- Unexpected requests for urgent or confidential transfers.
- Slight alterations in an email address or domain.
- Requests to keep transactions secret or avoid normal approvals.
How to prevent it: Verify changes to payment details through a previously established telephone number or another trusted channel. Require independent approval for high-value transfers, use dual authorization, and review payment anomalies.
Email authentication technologies such as SPF, DKIM, and DMARC can help protect against certain forms of email spoofing, but they do not eliminate impersonation or compromised-account risks.
7. Baiting and Malicious USB Devices
Baiting exploits curiosity, financial incentives, or the desire to obtain something useful. Attackers may offer fake downloads, free software, prizes, or physical devices that lead to malware infection or information theft.
Example: Someone finds a USB drive labeled “Confidential Payroll” in an office parking area. Curious about its contents, the person connects it to a work computer.
If the device contains malicious files or exploits a device vulnerability, it could expose the computer or organizational network to risk.
Warning signs:
- Unsolicited USB drives or storage devices.
- Downloads advertised as free premium software.
- Unexpected files that require unusual permissions.
- Offers that require disabling security protections.
How to prevent it: Never connect unknown storage devices to work or personal computers. Use approved software sources, endpoint protection, application controls, and policies that restrict unapproved removable media.
8. Tailgating and Physical Social Engineering
Tailgating occurs when an unauthorized person enters a restricted area by following an authorized individual through a secured entrance. The attacker may pretend to be a delivery worker, contractor, visitor, or colleague who has forgotten an access badge.
Example: An individual carrying several boxes approaches an employee entering a secure office. The individual asks the employee to hold the door open because their hands are full.
If the employee allows the person inside without checking authorization, the attacker may gain access to offices, devices, documents, or network equipment.
Warning signs:
- People asking to bypass badge checks.
- Visitors who cannot provide valid identification.
- Unescorted individuals in restricted areas.
- Requests to ignore physical security procedures out of politeness.
How to prevent it: Require every person to use the appropriate access-control process. Employees should politely direct visitors to reception rather than allowing unverified entry. Organizations can strengthen protection with visitor logs, access badges, security staff, and anti-tailgating controls.
9. Watering Hole Attacks
A watering hole attack compromises a website or online resource that members of a particular target group are likely to visit. The objective is to reach victims through a site they already trust.
Unlike a conventional phishing attack, the attacker may not need to send the victim a direct message.
Example: Attackers compromise a website frequently used by professionals in a particular industry. Visitors may encounter malicious content that attempts to exploit browser vulnerabilities or redirect them to fraudulent pages.
A successful attack could expose sensitive information or provide a route to further compromise.
Warning signs:
- Unexpected redirects from familiar websites.
- Security warnings or unusual browser behavior.
- Requests to install unfamiliar software or browser extensions.
- Unexplained downloads from websites that normally require none.
How to prevent it: Keep browsers, operating systems, and security tools updated. Use reputable endpoint protection, restrict unnecessary browser privileges, and investigate unexpected downloads or redirects.
Website owners should also maintain their software, monitor for unauthorized changes, and promptly address security vulnerabilities.
10. AI-Generated Impersonation and Deepfakes
Artificial intelligence can help attackers create convincing messages, synthetic voices, altered images, and realistic video impersonations. These tools can make social engineering more persuasive, particularly when combined with information collected from public sources.
AI-assisted attacks can overlap with phishing, vishing, spear phishing, and business email compromise. AI is a tool that can strengthen these existing techniques rather than a completely separate category of attack.
Example: An employee receives a video call that appears to show a senior executive requesting an urgent financial transfer. The caller sounds familiar and refers to genuine company projects.
The employee assumes the request is authentic and starts the transfer without following the normal approval process.
Warning signs:
- Unusual financial requests made during unexpected calls.
- Pressure to bypass normal payment procedures.
- Refusal to verify identity through a separate channel.
- Unexpected changes in communication patterns, even when the voice or video seems genuine.
How to prevent it: Use established identity-verification and payment-approval procedures. Verify unusual requests through a separate, trusted channel and use agreed internal verification methods for high-risk transactions.
Do not rely exclusively on visual glitches, unnatural speech, or other supposed deepfake clues. Synthetic media can be convincing, and legitimate recordings can also look or sound unusual.
Real-World Social Engineering and Cyberattack Cases
Documented incidents show why organizations must protect both their technology and the people who use it. However, not every major breach is a confirmed social engineering incident. The distinction matters when evaluating what actually happened and what lessons can reasonably be drawn.
Target Corporation: The 2013 Data Breach
In December 2013, Target disclosed unauthorized access that affected approximately 40 million credit and debit card accounts. The company later reported that information associated with up to 70 million individuals was also stolen. Investigations documented malware on point-of-sale systems.
The incident is frequently discussed in connection with third-party security and supply-chain risk. However, the presence of a vendor relationship does not mean every detail of the initial compromise should be described as a confirmed social engineering technique.
Security lesson: Organizations should limit third-party access, monitor vendor connections, segment sensitive systems, and investigate suspicious activity across their networks.
Sony Pictures Entertainment: The 2014 Cyberattack
In November 2014, Sony Pictures Entertainment suffered a major cyberattack involving destructive malware and the theft of proprietary information, employee personal information, and confidential communications. The FBI publicly reported findings from its investigation in December 2014.
The incident illustrates how a cyberattack can affect business operations, confidential communications, employee privacy, and intellectual property.
Security lesson: Maintain tested backups, restrict privileged access, monitor networks, develop incident-response plans, and prepare for the operational consequences of a serious breach.
Business Email Compromise: Documented Financial Losses
Business email compromise is another well-documented threat. The FBI has reported substantial cumulative losses associated with BEC complaints, reflecting the ability of impersonation and fraudulent payment instructions to cause significant financial damage.
The defining risk is not simply that a fraudulent email looks convincing. It is that the recipient may have the authority to move money, change supplier details, or disclose sensitive information.
Security lesson: Verify payment instructions independently, separate payment initiation from approval, and establish clear procedures for responding to unusual financial requests.
What These Incidents Have in Common
Across these cases, several practical lessons emerge:
- Technical controls must be supported by sound operational procedures.
- Third-party access should be limited to what is necessary.
- Employees need a simple way to report suspicious activity.
- Financial and privileged actions should require appropriate verification.
- Incident-response plans should be tested before an attack occurs.
These lessons are more useful than assuming every major breach happened through the same psychological trick.
Why Do Social Engineering Attacks Work?
Social engineering succeeds when an attacker influences a person’s decision-making before that person verifies the request.
Several psychological factors make these attacks effective.
- Authority bias: People may comply with someone who claims to be a manager, police officer, or IT specialist.
- Urgency: Time pressure reduces the opportunity to check whether a request is legitimate.
- Fear: Threats involving money, employment, legal consequences, or account suspension can trigger impulsive action.
- Curiosity: Unexpected files, sensational claims, and tempting offers encourage people to click.
- Trust and familiarity: Attackers imitate colleagues, suppliers, friends, or family members.
- Reciprocity: Someone who offers assistance or a reward may expect something in return.
- Routine and distraction: Busy employees may approve requests without applying the normal checks.
These factors are not evidence that victims are careless or unintelligent. Social engineering is designed to exploit ordinary human behavior, including the natural tendency to trust familiar people and respond to urgent situations.
Effective prevention makes safe decisions easier by building verification into everyday processes.
How to Prevent Social Engineering Attacks
The best defense combines individual awareness with organizational security controls. Training is important, but employees should not be expected to detect every sophisticated impersonation attempt on their own.
For Individuals
Use these practices to reduce the risk of phishing, identity theft, account compromise, and financial fraud.
- Verify unexpected requests. Contact the sender through a known phone number, official app, or independently verified email address.
- Avoid suspicious links and attachments. Navigate directly to the official website when checking an account or service.
- Never disclose authentication codes. Do not share one-time passwords, recovery codes, or passwords with unexpected callers or message senders.
- Enable multifactor authentication. Prefer phishing-resistant methods, such as passkeys or hardware security keys, when available.
- Use unique passwords. A reputable password manager can help generate and store different passwords for each service.
- Keep software updated. Install security updates for operating systems, browsers, applications, and mobile devices.
- Limit public personal information. Avoid sharing information that could make impersonation or targeted phishing easier.
- Report suspicious messages. Use the relevant platform’s reporting function or contact the organization being impersonated.
For Organizations
Organizations should combine technical safeguards, clear procedures, and regular employee education.
| Control | Purpose |
|---|---|
| Security awareness training | Helps employees recognize and report suspicious requests |
| Simulated phishing exercises | Tests reporting procedures and identifies training needs |
| Multifactor authentication | Makes stolen passwords less useful to attackers |
| Least-privilege access | Limits what a compromised account can reach |
| Email security controls | Helps detect or block malicious messages and spoofed email |
| Payment verification | Reduces fraudulent transfers and supplier-account changes |
| Network segmentation | Limits the spread of a compromise between systems |
| Endpoint detection and response | Helps identify suspicious activity on devices |
| Incident-response planning | Defines what to do when a compromise is suspected |
| Vendor security reviews | Helps manage risks from suppliers and third parties |
Security exercises should be designed to improve resilience, not shame employees. Organizations should measure reporting rates, response times, recurring weaknesses, and the effectiveness of corrective actions rather than relying solely on click rates.
For a broader risk-management framework, consult the NIST Cybersecurity Framework and CISA’s phishing recognition and reporting guidance .
What to Do If You Fall for a Social Engineering Scam
If you have clicked a suspicious link, shared sensitive information, installed unexpected software, or transferred money, act promptly. The appropriate response depends on what was exposed.
1. Secure affected accounts
From a trusted device, change compromised passwords, revoke active sessions where possible, and reset exposed recovery credentials. Secure the email account first if it can be used to reset other passwords.
2. Contact your bank or payment provider
If money or payment information is involved, report the incident immediately. Request a transfer recall, payment block, or card replacement where appropriate. Recovery is not guaranteed, so speed matters.
3. Report the incident
Notify your organization’s IT or security team, the impersonated service, or the relevant national cybercrime reporting authority. Preserve suspicious messages and transaction records.
4. Check affected devices
If you installed software or opened a suspicious attachment, contact a trusted security professional or your organization’s IT team. Disconnect a potentially compromised device from the network when appropriate, and avoid using it for sensitive transactions until it has been assessed.
5. Monitor for further misuse
Review account activity, financial statements, password-reset alerts, and identity-related notifications. Watch for follow-up scams that exploit the information already disclosed.
If the incident involves cryptocurrency, secure the affected exchange account and email account immediately. If wallet recovery phrases or private keys have been exposed, treat the associated wallet as compromised and seek trustworthy, wallet-specific recovery guidance. Blockchain transactions are generally irreversible, and no recovery service can guarantee that stolen funds will be returned.
Social Engineering Statistics and Sources
Statistics can help explain the scale of cybercrime, but only when their definitions, reporting periods, and limitations are clear.
What the available evidence shows
1. Reported internet crime losses are substantial. The FBI announced in April 2025 that its 2024 Internet Crime Report included 859,532 complaints of suspected internet crime and more than $16 billion in reported losses, a 33% increase from 2023. These figures cover reported internet crime broadly; they are not a measurement of social engineering losses alone.
2. Phishing and pretexting remain important security concerns. Verizon’s 2024 Data Breach Investigations Report found that pretexting featured in more than 40% of the social engineering incidents examined, while phishing featured in 31%. These percentages describe the report’s analyzed incident dataset, not the probability that any individual phishing attempt will succeed.
3. Business email compromise creates significant financial exposure. The FBI’s cumulative BEC figures demonstrate that fraudulent business communications can result in losses across both domestic and international victims. The figures are complaint-based and should not be interpreted as a complete accounting of all worldwide incidents.
How to interpret cybersecurity statistics correctly
When evaluating a statistic about social engineering, ask:
- What year or reporting period does it cover?
- Does it measure attacks, attempted attacks, incidents, confirmed breaches, complaints, or financial losses?
- Is the figure global or limited to a particular country or industry?
- Is the source reporting actual observations or making a forecast?
- Are the figures independently verified, and what limitations does the source disclose?
Avoid combining incident counts, attack success rates, breach costs, and reported fraud losses into a single comparison. These measurements describe different things and are not directly interchangeable.
For ongoing research, consult the Verizon Data Breach Investigations Report and the FBI IC3 annual reports . Check for newer editions before publishing annual statistics.
Frequently Asked Questions
What is a real-life example of a social engineering attack?
A common example is a fraudulent phone call in which someone impersonates a bank employee and asks a customer to disclose a one-time passcode. The attacker may use that code to access an account or authorize a transaction. The safe response is to end the call and contact the bank through an independently verified channel.
What are the most common types of social engineering attacks?
Common types include phishing, spear phishing, smishing, vishing, pretexting, impersonation, business email compromise, baiting, and tailgating. Watering hole attacks and AI-generated impersonation are additional techniques that can be used to reach or deceive specific targets.
What is the difference between phishing and social engineering?
Phishing is one type of social engineering. It typically uses deceptive emails, messages, websites, or other communications to steal information or trigger unsafe actions. Social engineering is the broader category and also includes phone scams, physical impersonation, fraudulent payment requests, and other forms of manipulation.
How do social engineering attacks work?
Attackers research their targets, create a believable story, and exploit trust, urgency, fear, curiosity, or authority. They then persuade the victim to disclose information, click a link, install software, approve access, or transfer money. Verification procedures and security controls can interrupt this process.
Why are social engineering attacks dangerous?
They can bypass some technical safeguards by persuading legitimate users to perform actions with their own access. Consequences can include financial fraud, stolen identities, compromised accounts, data breaches, malware infections, operational disruption, and reputational damage.
How does AI make social engineering attacks more convincing?
AI can help attackers generate personalized messages, imitate writing styles, produce synthetic voices, and create manipulated images or videos. These capabilities can make impersonation more convincing, but they do not guarantee that an attack will succeed. Independent identity checks and established approval processes remain essential.
How can businesses prevent social engineering attacks?
Businesses should combine regular security training with MFA, least-privilege access, email security, independent payment verification, vendor controls, incident-response procedures, and straightforward reporting channels. High-risk requests should require verification independent of the original message.
Are small businesses vulnerable to social engineering?
Yes. Small businesses can be targeted through fake invoices, supplier impersonation, account-takeover attempts, fraudulent technical support, and phishing. Limited security resources can increase exposure, making basic controls such as unique passwords, MFA, payment verification, backups, and employee training especially important.
What should I do if I accidentally clicked a phishing link?
Do not enter additional information or download anything else. If you submitted credentials, change the affected password from a trusted device and revoke active sessions if possible. If you installed software, seek security assistance. Report the message and monitor affected accounts for suspicious activity.
How can I recognize a business email compromise scam?
Look for unexpected payment instructions, supplier bank-account changes, unusual requests from executives, and pressure to bypass established procedures. Email addresses and writing styles can be imitated, so verify financial instructions using a trusted, separate communication channel.
What role does social media play in social engineering?
Public profiles can reveal job roles, personal interests, business relationships, travel plans, and organizational details. Attackers may use this information to create believable impersonation attempts. Limit unnecessary public disclosures and verify unexpected requests, even when they refer to genuine personal or professional details.
Can multifactor authentication prevent social engineering attacks?
MFA can reduce the risk of account takeover when a password is stolen, but it does not stop every social engineering attack. Attackers may attempt to trick victims into approving fraudulent login requests or disclosing authentication codes. Phishing-resistant authentication, such as passkeys or security keys, offers stronger protection against many credential-phishing techniques.
Conclusion
Social engineering attacks exploit human trust and decision-making to gain access to information, accounts, systems, or money. Phishing emails, fraudulent phone calls, impersonation, business email compromise, physical intrusion, and AI-generated deception are different methods, but they share the same underlying objective: persuading a target to take an unsafe action.
The strongest defense combines human awareness with practical safeguards. Individuals should verify unexpected requests, protect authentication credentials, and report suspicious activity. Organizations should enforce payment controls, limit access, secure their systems, and make it easy for employees to question unusual instructions.
Real-world cyber incidents demonstrate why neither technology nor training is sufficient on its own. A resilient security strategy treats people, processes, third parties, and technology as connected parts of the same defense.
