What is social engineering?
Definition
Social engineering is tricking a person into giving up information or taking an action, such as sharing a password or sending money, by exploiting trust, fear or urgency instead of breaking into a system.
- Category
- Attacks
- Also called
- social engineer, human hacking
- Last updated
Most hacking stories involve code. Social engineering skips the code and goes after the person. CISA describes it as an attacker using human interaction, meaning social skills, to obtain or compromise information about an organization or its computer systems. The attacker's tools are a believable story and a bit of pressure.
How it works
The attacker picks a role you'd trust: your bank, your boss, IT support, a delivery company, a government agency. Then they give you a reason to act now. Your account is locked. A package is stuck. The CEO needs gift cards in 20 minutes. The goal is to get you to click a link, hand over a code, install something or send money before you stop to think.
A typical case: you get a text saying your parcel can't be delivered and you need to "confirm your address" on a link. The page asks for your card details. Nobody hacked anything. You were talked into it.
Common forms
- Phishing is social engineering by email or fake websites. CISA classes it as a subset of social engineering.
- Smishing is the same trick by text message, and vishing is by phone call.
- Spear phishing targets a specific person, often using details found online.
- Pretexting is building a made-up scenario to get information, for example posing as a colleague.
Why your public details matter
A convincing story needs facts. Attackers often start with what's easy to find about you: your name, employer, relatives, past addresses and phone number. The more of that sits on people-search sites and public profiles, the easier it is to write a message that feels real.
Social engineering vs. hacking
Hacking attacks a system. Social engineering attacks the person using it. They're often combined: a stolen password from a phishing email is used to log in to your account, no technical exploit needed.
How to protect yourself
- 1
Slow down when a message creates urgency
Urgency is the main lever. If a message demands immediate action, pause. Real organizations rarely need you to act within minutes.
- 2
Verify through a channel you control
Don't use the link or number in the message. Go to the official website yourself or call the number on your card or statement.
- 3
Never share one-time codes or passwords
No legitimate support agent will ask for a verification code sent to your phone. Turn on two-step verification so a stolen password alone isn't enough.
- 4
Limit what strangers can learn about you
Tighten your social media privacy settings and cut down on public details like your employer, birthday and family names. Serus finds where your personal details are listed, including people-search sites, and removes them, which takes material away from someone building a convincing story.
- 5
Report it
In the US, report scams at ReportFraud.ftc.gov. If you already gave away a password, change it on that account and any other that reuses it.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is an example of social engineering?
A caller says they're from your bank's fraud team and asks you to read out a code they've just "sent" you. The code is actually a login code for your account, so you've handed over access yourself.
What is a social engineer?
A social engineer is a person who uses persuasion and deception, not technical hacking, to get others to reveal information or take an action. Their methods include impersonation, fake urgency and flattery.
Is phishing the same as social engineering?
Phishing is one type of social engineering, carried out through email or fake websites. Social engineering is the wider category and also includes phone calls, text messages and in-person tricks.
Can antivirus software stop social engineering?
Not by itself. The attack works by persuading you, so it can happen with no malicious file at all. Checking who is really contacting you is the better defense.
Sources
Something wrong or out of date? Tell us and we'll re-check it.