Glossary
Social engineering
Social engineering is the art of manipulating people into giving up information or access, instead of breaking technology to get it.
What it means
Social engineering is the art of manipulating people into giving up information or access, instead of breaking technology to get it. The attacker does not hack a system — they hack the human: a phone call from someone pretending to be IT support, an email that looks like it comes from your boss, a message that creates urgency so you act before you think. It works because it targets trust, authority, helpfulness, curiosity and fear — the normal human instincts that make organisations function.
How it works
Social engineering has a vocabulary of its own. Pretexting is inventing a scenario — a support ticket, an audit, a delivery problem — to justify the request. Business email compromise is impersonating a senior colleague or a supplier to redirect a payment. Baiting offers something attractive, such as a free download, that carries a hidden cost. Tailgating is following someone through a secure door. The techniques change, but the structure is constant: a plausible premise, a trusted identity, a reason to act quickly, and a request that seems small. The defence is also constant, and it is a habit rather than a product: pause, verify the request through a channel you control, and never act on urgency alone. Two-factor authentication is the layer that catches the cases where the manipulation succeeds anyway.
Example
Imagine a fictional finance officer, Priya, who receives an email that appears to come from her company's director: an urgent request to pay a supplier invoice today, with new bank details attached. The email uses the director's name, the right tone, and a genuine-looking signature. Priya's first instinct is to pay — the director asked, and it is urgent. Instead she pauses, calls the director on the number she already has, and learns the director sent nothing. The email was business email compromise, and the pause was the defence. The technique was not sophisticated; the discipline to verify was.
Common misunderstandings
The most common misunderstanding is that social engineering only works on careless or naive people. It does not: it works on busy, helpful, competent people, because it targets the qualities that make them good at their jobs. The second misunderstanding is that security training makes you immune. It reduces the risk and teaches the habit — but a well-made pretext on a busy day can deceive anyone, which is why verification procedures matter more than individual vigilance.
Related terms
Learn more
- Social engineering awareness
- Phishing awareness
- What is BEC fraud?
- Cybersecurity Awareness Path
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
Is social engineering the same as phishing?
Phishing is one kind of social engineering — the kind that arrives as a message. Social engineering is the broader family: it includes phone calls, face-to-face tricks, fake invoices and any manipulation that targets a person instead of a system.
Can training stop social engineering?
It reduces the risk a lot, and it teaches the habit that matters — pause and verify through a channel you control. But no training makes anyone immune, which is why organisations also use procedures: two-person approval for payments, and verification rules that do not depend on one person's judgement.
What should I do if I suspect social engineering?
Pause and do not act on the request. Verify through a channel you already trust — call the person on a number you already have, or check in the company's own system. If it is a request for money or credentials, escalate it to your security team or manager before doing anything.