What is Social Engineering?

Social engineering is the practice of getting someone to hand over access, money or information by persuasion rather than by breaking into a system. It is older than computers, but computers made it cheap: the same script can reach a million inboxes, and the same voice can call a hundred accounts payable clerks in an afternoon. Verizon’s annual breach report has found for years that most successful attacks on businesses involve a person being persuaded of something untrue. This article describes the forms it takes in 2026, why it works on capable people, and the small number of habits that defeat it.

The forms it takes

Phishing

Email that pretends to be from a service or a colleague and asks you to sign in, open a file or approve something. It is the most common form and the delivery vehicle for most others. Our phishing quiz shows ten realistic examples with the tells explained.

Spear phishing and business email compromise

The targeted version. The attacker knows your name, your boss’s name and the vendor you pay every month, because all of it is on the web. Business email compromise is the money-making end of it: an email from “the owner” asking for gift cards, from “the supplier” announcing new bank details, or from “the CFO” asking for a wire before the close. Losses from this exceed losses from ransomware for small businesses, year after year.

Vishing and smishing

The same tricks by phone and by text message. A call from “Microsoft support” about a virus, from “the bank” about fraud on the account, or from “your IT company” asking for the code that was just sent to your phone. Text messages carrying a package-delivery link or a payroll notice do the same job with fewer words.

Pretexting

A story that makes the request reasonable. The new hire who needs the Wi-Fi password, the auditor who needs a report, the executive who is in a meeting and cannot talk but needs this done now. Pretexting is the part of the attack that is written before the first contact.

MFA fatigue and help-desk impersonation

Once multi-factor authentication became common, attackers moved to defeating the human half of it. Push bombing sends approval prompts to a phone over and over, at night, until the owner taps approve to make it stop. Help-desk impersonation reverses the call: the attacker phones your IT provider, or your own IT person, pretending to be an employee who lost their phone, and asks for the second factor to be reset. Several large companies have been breached exactly this way.

Deepfake voice and video

Voice cloning needs a few seconds of audio, which a podcast interview or a voicemail greeting provides. Finance teams have now wired money after video calls in which every other participant was synthetic. This is rare against small businesses so far, but the cost of doing it is falling every year, and the defence is the same as for every other form.

Baiting and tailgating

The physical versions: a USB drive labelled “salaries” left in the car park, or a person in a hi-vis vest carrying a ladder who follows an employee through the badge door. Both still work.

Why it works on capable people

Social engineering is not aimed at careless people. It is aimed at how everyone thinks when three things line up: authority (the request seems to come from someone who can give orders), urgency (there is a deadline and a consequence), and familiarity (the name, the logo, the writing style all look right). Add a plausible story and a busy afternoon, and the person does the reasonable thing, which was the wrong thing. Executives and finance staff are the preferred targets because their reasonable thing moves money.

What it looks like in a Minneapolis office

The patterns we see most, in roughly the order of how much they cost: a supplier’s invoice arriving with new bank details, paid without a phone call; an executive’s mailbox taken over through a phished password and then used to redirect a customer’s payment; a payroll change request from an employee’s “new personal email”; a gift-card errand from the boss who is “in a meeting”; and a call to a staff member from “IT” that ends with the caller holding the multi-factor code. None of these involve a technical exploit. Every one of them involves a person doing what seemed right.

The habits that defeat it

1. Verify by a second channel, every time money or credentials are involved. A change of bank details is confirmed by calling the number you already had for the vendor, never the number in the email. This one rule prevents most business email compromise.
2. Multi-factor authentication with number matching on every account, so a stolen password is not enough and a push-bombing prompt cannot be approved blindly. Phishing-resistant options, such as passkeys and hardware keys, close the rest. See our guide to setting up MFA.
3. A help-desk process that cannot be talked around. Nobody resets a second factor or a password on the strength of a phone call alone; identity is confirmed through a channel the caller does not control.
4. Email security that flags impersonation, and SPF, DKIM and DMARC so attackers cannot send as your own domain to your own staff.
5. Least privilege, so the person who is tricked cannot approve a wire alone, install software, or reach every file.
6. Training with simulated attacks, on a schedule, so recognising the pattern becomes a reflex rather than a memory of a slideshow. Our security awareness training runs this for clients through the year.
7. A culture where reporting is safe. The employee who says “I think I clicked something” within the hour has saved the company. The one who hides it for a week has not.

If it has already happened

Report it the moment you suspect it. If money moved, call the bank first; wires can sometimes be recalled within hours. Change the password on the affected account from a different device, revoke its sessions, and check the mailbox for forwarding rules the attacker added. Then have the computer checked. Our managed cybersecurity services include monitoring for the takeover attempts that follow a successful phish, which is where most of the damage is done.

Common questions

Is social engineering the same as phishing?

Phishing is one form of social engineering, the most common one. Social engineering is the broader category: any attack that works by persuading a person rather than breaking a system, including phone calls, text messages, in-person visits and fake video calls.

Why do smart people fall for it?

Because the attack is designed for how everyone thinks under pressure, not for how careless people think. Urgency, authority and familiarity are the levers, and they work on executives at least as well as on anyone else; executives are the preferred targets.

Does multi-factor authentication stop social engineering?

It stops the version that relies on a stolen password, which is most of it. Attackers answered with MFA fatigue, where they trigger prompt after prompt until someone taps approve, and with fake help-desk calls that talk people through handing over the code. Number matching and phishing-resistant sign-in close those gaps.

What should I do if I think I was tricked?

Say so immediately, to your IT provider and your bank if money was involved. The first hour matters most: a wire can sometimes be recalled, a password can be changed before it is used, and a machine can be isolated before anything spreads. Nobody who reports quickly is the problem.

Talk to us

If your staff have never seen a simulated phishing email, the first real one is the test. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.