What is social engineering in cybersecurity?

Social engineering is the manipulation of people into taking actions or disclosing information that compromises security, such as entering credentials on a fake page, approving a fraudulent payment or resetting an attacker's MFA. It targets human judgement instead of a technical vulnerability, which is why most intrusions begin with it.

What are the most common social engineering techniques?

The phishing family (email, SMS, voice, QR and deepfake variants) is the most common, followed by pretexting, help-desk and MFA-reset fraud, invoice and supplier bank-detail fraud, baiting with devices or offers, and tailgating into premises. In 2026 nearly all of these are assisted by AI for research, language and voice cloning.

Pretexting is the construction of a false identity and scenario, such as an auditor, a supplier contact or a service-desk technician, to make a request appear legitimate. It is often sustained across several contacts and underpins most other social engineering techniques.

Can you give an example of a social engineering attack on a company?

A typical example is CEO fraud: a controller receives emails that appear to come from the chief executive about a confidential acquisition and transfers funds to a foreign account under time pressure. A widely reported Dutch case in 2018 cost a cinema chain around twenty million euros without any technical control being breached.

How do organisations prevent social engineering?

Through process controls that do not depend on spotting a fake: out-of-band verification of payments and bank-detail changes, strong identity proofing at the service desk, phishing-resistant MFA, an escorted-visitor policy and a reporting culture. Role-based training supports these controls, and regular testing confirms they are followed.

Is social engineering testing legal?

Yes, when performed under written authorisation from the organisation, within agreed rules of engagement and with attention to employment law and privacy. In the Netherlands this typically involves HR and, for larger organisations, the works council. Reputable providers never name individuals in reports and avoid pretexts involving pay, dismissal or health.

How is a social engineering test different from a phishing simulation?

A phishing simulation measures one channel, email, across the whole workforce on a recurring basis. A social engineering test is scenario-based and multi-channel: phone pretexts to the service desk, supplier fraud routed to finance, on-site impersonation and voice cloning where in scope. The first gives you a trend; the second tells you which processes hold against a prepared adversary.

1 November 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)

What is social engineering? How attackers manipulate people, and how organisations defend against it

Social engineering is the manipulation of people into taking an action or disclosing information that undermines security: approving a payment, sharing a password, resetting MFA, holding a door open. The attacker does not break a control; they persuade someone with legitimate access to use it for them. This guide covers the psychology, the technique families, real patterns and the process controls that actually hold.

Test your resilience to social engineering

Social engineering defined

Social engineering is any attack that targets human judgement rather than a technical weakness. The attacker constructs a situation in which the natural, helpful, compliant response of an employee is also the response that hands over credentials, money, access or information. Technical controls are not bypassed so much as operated by the victim on the attacker's behalf. In the MITRE ATT&CK framework the most common entry technique, Phishing (T1566), sits under Initial Access for exactly this reason: it is how most intrusions begin.

The business impact is well documented. The Verizon Data Breach Investigations Report has for successive years attributed a majority of confirmed breaches to a human element. Regulators have responded by treating the human layer as a control that must be designed, trained and tested. NIS2 Article 21(2)(g) requires basic cyber hygiene practices and cybersecurity training as a risk-management measure. ISO 27001:2022 control A.6.3 requires awareness, education and training. DORA Article 13(6) requires financial entities to run ICT security awareness programmes and digital operational resilience training. In each case the regulator's position is the same: a successful manipulation of an employee is an organisational failure, not a personal one.

What separates a targeted attack on an organisation from the scam mail everyone receives is the research phase. Before the first contact, a serious attacker studies the target: the organisational chart on LinkedIn, the press release about an acquisition, the supplier logos on the website, the tender award in a public register, the credential pairs in a leaked database, the voice of the CFO on a quarterly results call. The pretext is built on those facts, which is why it sounds right. Defending against social engineering means defending against a prepared adversary who knows your vocabulary, your tools and your reporting lines.

The six psychological levers every attack pulls

Decades of persuasion research, from Cialdini onward, describe a small set of triggers that short-circuit careful judgement. Every social engineering technique combines two or three of them.

Authority

People comply with perceived rank or institutional weight: a message from the CEO, a call from the bank's fraud department, an email from the auditor, a ticket from the IT service desk. The lever works best when the role is real and only the person is false.

Urgency

Compressing time removes the verification step. The payment must leave before the bank's cut-off, the account will be locked in ten minutes, the acquisition announcement is tomorrow. Urgency is almost always present; its absence is a sign the request may be genuine.

Reciprocity

A favour creates an obligation. The helpful technician who has just fixed your VPN now needs your one-time code to close the ticket, and refusing feels ungrateful.

Social proof

Others have already acted, so acting is safe. A forwarded thread in which colleagues appear to have approved, a note that the rest of finance has completed the new supplier form, or a message sent from a genuinely compromised colleague mailbox.

Scarcity

Limited places, a closing window, a final notice, an exclusive opportunity. Scarcity pushes the target to act before thinking; asking a colleague feels like missing out.

Familiarity and liking

Rapport built over several contacts, a shared background, flattery, a mirrored tone. The fraudster is pleasant and the request feels like helping a colleague. Long-running pretexts rely on this lever more than on any other.

The phishing family

Phishing is the largest family of social engineering techniques: a message that impersonates a trusted sender to harvest credentials, deliver malware or trigger a payment. Its variants differ mainly by channel and by how much research went into the target. Spear phishing is researched and individual; business email compromise and CEO fraud redirect payments without any malware at all; smishing uses SMS; vishing uses the phone; QR phishing moves the malicious link onto paper or a screen where email filters cannot see it; deepfake voice phishing adds a cloned voice to the call. Platform-specific forms such as Microsoft 365 credential phishing, OAuth consent phishing and phishing inside Slack and Teams exploit the tools people trust most. Each of these has its own module in our free security awareness library, linked directly below, and this guide deliberately does not re-explain them.

Every variant can be described with four elements: a channel, one of the six levers above, a target role and a payload (a credential, a payment, access, or information that enables the next step). The same four elements describe the families beyond email that follow.

Phishing variants explained in the free awareness library

Practitioner-written modules, no paywall. Each explains one variant, what it looks like in practice and what to do when you see it.

Beyond the inbox: the other technique families

Described at the level a CISO, a controller or a facilities manager needs in order to recognise the pattern and design a control. Not a playbook.

1. Pretexting

A fabricated identity and scenario, sustained across one or many contacts: the external auditor who needs a system export, the new contact at a known supplier, the recruiter, the journalist, the regulator's inspector. Pretexting is the foundation under most other techniques. A professional pretext often opens with harmless requests that gather the details (names, ticket numbers, system vocabulary, who is on leave) that make the real request credible days later.

2. Baiting and quid pro quo

Baiting offers something the target wants: a USB drive left in the car park or at reception, a free tool, a gift card. Quid pro quo offers a service in exchange for access, most often the unsolicited IT support call that will solve a problem you did not know you had, provided you share a code or install a remote-access tool.

3. Invoice and supply-chain fraud

The attacker compromises or convincingly impersonates a supplier and asks accounts payable to update bank details, typically timed to coincide with a real, expected invoice. In its most patient form the attacker sits silently inside a compromised mailbox for weeks, reading the correspondence, and steps into a genuine thread at the moment of payment (conversation hijacking). Dutch municipalities, housing associations and hospitals have all paid genuine invoices to fraudulent accounts this way, as public council and court records show.

4. AI-assisted attacks

Large language models have removed the language tell: a pretext written in fluent, idiomatic Dutch with the right regional register costs nothing to produce. Voice cloning has changed the economics of the phone call: a few seconds of public audio from a results call or a podcast is enough for a convincing clone, and in 2024 the Hong Kong office of a multinational engineering firm transferred roughly USD 25 million after a video call in which every other participant, including the apparent CFO, was a deepfake. A newer vector turns the organisation's own AI assistants into the target: a document or email containing hidden instructions (prompt injection) that an internal copilot then executes. Our AI penetration testing service exists for that last category.

At the service desk and at the door

Help-desk and MFA-reset fraud is the technique behind many of the largest recent intrusions. The attacker calls the IT service desk as an employee and asks for a password reset or the enrolment of a new MFA device, armed with the personal details that identity verification scripts usually accept; MFA fatigue (repeated push notifications until the user taps approve) and SIM swapping at the mobile operator are the common follow-ups. In 2023 a US hospitality group suffered a multi-week outage and reported losses in excess of USD 100 million after an intrusion that reportedly began with a short call to its service desk. The phone-side tradecraft is the subject of the vishing module in our free awareness library, linked above; the organisational fix is a reset procedure that does not depend on knowable facts.

Tailgating and impersonation on site are the physical expression of the same levers: following an employee through a secured door, arriving as a courier, a contractor in a hi-vis vest, a cleaner or a new hire who forgot a badge, then moving to a meeting room with a live network port, a printer tray or an unlocked comms room. The physical side of social engineering is its own discipline, with its own authorisation and safety rules, and is covered in depth in our physical penetration testing guide, linked at the end of this article.

Technique families at a glance

Use the last column as the starting point for your control design. Each family has one control that, if present and actually followed, defeats the majority of attempts.

Family	Channel	Main lever	Typical target	First line of defence
Phishing family	Email, SMS, chat, QR	Urgency, authority	Any employee	Reporting culture plus phishing-resistant MFA
Pretexting	Any, usually sustained	Familiarity, authority	Service desk, assistants, finance	Identity verification before any disclosure
Baiting and quid pro quo	Physical media, unsolicited help	Reciprocity, curiosity	Reception, open-plan staff	Device control; IT never calls unprompted
Tailgating and impersonation	In person	Social proof, liking	Reception, all staff	Badge-every-time culture; escorted visitors
Help-desk and MFA-reset fraud	Phone to IT	Authority, urgency	IT service desk	Strong identity proofing for resets; manager call-back
Invoice and supply-chain fraud	Email, letter, portal	Familiarity, authority	Accounts payable, procurement	Bank-detail changes verified out of band, four-eyes
AI-assisted attacks	All of the above	All of the above	All of the above	Process controls that do not depend on spotting a fake

Real-world patterns, anonymised

The classic Dutch case remains the CEO fraud at a cinema chain in 2018. A controller received emails from what appeared to be the group CEO about a confidential acquisition, was told the matter could not be discussed internally, and transferred around twenty million euros in tranches to foreign accounts. The subsequent dismissal of senior managers was fought out publicly in the Amsterdam courts. Every lever was present: authority, urgency, secrecy as a form of scarcity, and a fabricated email trail as social proof. Not one technical control failed.

A second recurring pattern is the service-desk reset. The attacker identifies an employee with privileged access through LinkedIn, learns enough about them to pass the help desk's questions, and has a password and MFA device reset in a ten-minute call. From there the intrusion is technical, often ending in ransomware. The root cause was that the help desk had no reliable way to confirm who was calling and no rule that said resets for privileged accounts require a call back to a manager.

The third pattern is the slow supplier. An attacker gains access to a supplier's mailbox, or registers a lookalike domain, and watches the correspondence until a large invoice is due. The request to update the IBAN arrives in the real thread, with the real reference numbers. Accounts payable processes it because the procedure for bank-detail changes was an email confirmation, and the email confirmation came back from the attacker. Dutch public bodies have reported losses in the millions this way, and the pattern repeats because the fix is procedural rather than technical and therefore nobody's budget line.

How organisations defend against social engineering

Awareness matters, but the organisations that resist social engineering do so because their processes do not depend on an individual spotting a fake. Build in this order.

Out-of-band verification for every payment instruction and bank-detail change: a call back on a number already on file, never on a number in the request, with four-eyes approval above a threshold
Identity proofing at the IT service desk that does not rely on knowable facts (date of birth, employee number); for privileged accounts, resets require manager confirmation or in-person verification
Phishing-resistant MFA (FIDO2 or passkeys) for email, identity provider and remote access, so that a harvested password plus a one-time code is not enough
A one-click report button in the mail client, a response to every report within the working day, and a stated no-blame policy; the report rate is the metric that matters, not the click rate
A visitor process that badges and escorts everyone, with staff explicitly authorised and expected to challenge an unbadged person
Rules that remove the attacker's favourite channels: IT never asks for codes by phone, executives never request payments by email or chat, bank-detail changes are never accepted by email alone
Least privilege and segmentation so that one manipulated employee cannot hand over the whole environment
Role-based training for finance, HR, the service desk, executive assistants and executives themselves, refreshed with current pretexts, using material such as our free security awareness library
Device control and clear handling rules for found media, unexpected deliveries and unsolicited support calls
Regular testing of all of the above against real people and real processes, with results fed back into the controls rather than into disciplinary files

Testing your resilience to social engineering

A policy is a hypothesis about behaviour. A social engineering test checks it. In a HackersHub engagement, our consultants attempt, under written authorisation and agreed rules of engagement, the same approaches a real adversary would use: a phishing campaign built from your actual vocabulary and tools, pretext calls to the service desk requesting a reset, a supplier bank-detail change routed to accounts payable, and on-site attempts if the physical layer is included. Every scenario is agreed in advance with your security lead, HR and, where applicable, the works council. Nobody is named in the report, and the deliverable is a measured view of which processes held and which did not.

Where social engineering is the entry point of a larger exercise, it becomes the initial access phase of a red team operation, measured not only by whether someone clicked but by how far the attacker got before detection and response stopped them. Where the question is specifically about buildings and people, a physical penetration test is the right instrument. Where you want a recurring measurement of the whole workforce, a managed phishing simulation programme is the instrument. All three are delivered by the same team: hands-on experts, every tester OSCP-certified, with 10+ years of offensive security expertise and a 4.9/5 rating across 127 reviews.

For NIS2 entities, financial institutions under DORA and ISO 27001 certificate holders, a documented social engineering test is the most direct evidence that the training and awareness controls in Article 21(2)(g), Article 13(6) and control A.6.3 operate in practice rather than on paper. The report maps findings to those clauses and includes the remediation that turns a near miss into a procedure.

Frequently asked questions

Find out which of your processes hold against a prepared adversary

A scoping call with our lead tester defines the scenarios, the rules of engagement and the people who need to be informed. You receive a written scope and a named lead before anything starts. Schedule a call.

Social engineering testing by HackersHub Talk to an expert