What is an example of social engineering?
Definition
Social engineering examples include a fake IT call asking for your password, a spoofed bank email or an urgent text with a link: any scam that tricks you into handing over information or access.
- Category
- Attacks
- Also called
- social engineering examples
- Last updated
Social engineering attacks work on people, not software. The attacker doesn't break in; they persuade you to let them in. Social engineering is the umbrella term, and CISA describes phishing (email), vishing (phone) and smishing (text) as its main forms.
Common examples
- The fake colleague or IT desk. CISA notes attackers often pose as a trusted coworker, IT staff or a known vendor, sometimes with a lookalike domain or a fake login page. You get an email asking you to "verify your password" on a page that copies the real one.
- The spoofed phone call. Caller ID can be faked, so a call can appear to come from your bank or a government office. The caller says there's a problem with your account and asks for a code or your details. See phone spoofing and vishing.
- The urgent text. A message says a package is stuck or an account is locked and gives a link. That's smishing.
- The message from a friend. If someone's account is hijacked, their contacts get messages that look genuine, usually with a link or a request for money.
- The tailored approach. The attacker uses details they found about you, such as your employer, your address or a relative's name, to sound believable. That's pretexting and, when aimed at one person, spear phishing.
What they share
CISA lists manufactured urgency as a common warning sign: a demand to act immediately, before you can think or check. The other giveaways are an unexpected request for personal details or a login, and a link or number you didn't look up yourself.
Why personal details matter
The more an attacker knows about you, the better the story. Home addresses, phone numbers and family names often come from people-search sites and public records, which is why removing them makes these scams harder to pull off.
How to protect yourself
- 1
Verify through a channel you already trust
If a message seems off, contact the organization using a number or website you already have, not the one in the message.
- 2
Check links before you click
Hover over a link to see where it goes, or type the known address into your browser yourself.
- 3
Don't share details with unverified contacts
Withhold personal information, codes and passwords from anyone who contacts you first.
- 4
Use phishing-resistant sign-in
CISA recommends multifactor authentication such as security keys, since weaker methods can still be tricked.
- 5
Report, don't forward
Report suspicious messages to your IT team or the platform, and report scams to the FTC at ReportFraud.ftc.gov.
- 6
Shrink what scammers can find
Serus finds where your address and phone number are listed and removes them, so there's less to build a convincing story from.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the most common example of social engineering?
Phishing, a fake email that pushes you to click a link or share a login. CISA groups it with vishing (calls) and smishing (texts) as the main forms.
Is a phone call from a fake bank social engineering?
Yes. The caller relies on trust and urgency, not technical hacking, to get your details or a one-time code.
How can I spot a social engineering attempt?
Look for pressure to act now, requests for passwords or codes, and links or numbers you didn't choose. When in doubt, stop and verify independently.
Sources
Something wrong or out of date? Tell us and we'll re-check it.