Cybersecurity attacks do not always begin with someone exploiting a technical vulnerability. Sometimes the easiest way into a business is simply convincing an employee to open the door.
That is the idea behind social engineering: manipulating people into revealing information, granting access, transferring money, clicking a malicious link, or taking some other action that weakens security.
Attackers may impersonate executives, vendors, customers, coworkers, financial institutions, or IT support personnel. They often research their targets in advance so the request sounds believable.
Technical safeguards such as firewalls, endpoint protection, email filtering, and multi-factor authentication are important, but employees also need to recognize when someone is trying to manipulate them.
Here are five common examples of social engineering attacks businesses should understand.
1. Phishing
Phishing is one of the most common forms of social engineering.
An attacker sends an email, text message, social-media message, or other communication designed to look like it came from a trusted source. The goal is usually to convince the recipient to:
- click a malicious link,
- open an infected attachment,
- enter a username and password into a fake login page,
- provide sensitive information,
- or take some other action that benefits the attacker.
A phishing message might appear to come from Microsoft asking an employee to verify their Microsoft 365 account. Another might look like a shipping notification, bank alert, voicemail message, or shared document.
Modern phishing emails can be difficult to recognize because attackers can imitate legitimate branding, writing styles, and login pages.
NIST recommends training employees to recognize and report phishing attempts, using email filtering and email-authentication technologies, and requiring multi-factor authentication on accounts that support it.
Why MFA matters
A stolen password does not necessarily have to result in a compromised account. Multi-factor authentication adds another verification step that can make unauthorized access substantially more difficult.
If your organization uses Microsoft 365, see our guide to activating multi-factor authentication for Microsoft 365.
2. Pretexting and Impersonation
In a pretexting attack, the attacker creates a believable storyโor pretextโto convince someone to provide information or perform an action.
For example, someone might call an employee and claim to be:
- an IT technician troubleshooting a problem,
- an executive who urgently needs information,
- a vendor updating an account,
- a bank representative investigating suspicious activity,
- or a new employee who needs help accessing a system.
The attacker may already know the names of company executives, departments, vendors, software platforms, or other details gathered from websites, social media, previous data breaches, or other public sources.
That information makes the request sound legitimate.
An employee might think:
"They know who my manager is, they know which accounting system we use, and they know the name of our IT company. This must be legitimate."
But knowing those details does not prove the caller's identity.
How to reduce the risk
Employees should be encouraged to verify unusual requests using a separate, trusted communication method.
For example, if someone claiming to be a vendor calls requesting sensitive information, the employee should contact the vendor using the phone number already on file rather than a number supplied by the caller.
The same principle applies to internal requests. Sensitive information, password resets, financial changes, and access requests should follow established procedures rather than relying solely on someone appearing knowledgeable or authoritative.
3. Business Email Compromise and Executive Fraud
Business Email Compromise, commonly called BEC, combines social engineering with email impersonation or account compromise.
An attacker may impersonate:
- a company owner,
- CEO or executive,
- accounting employee,
- customer,
- supplier,
- or other trusted business contact.
The attacker then asks an employee to send money, purchase gift cards, change banking information, provide payroll records, or disclose confidential information.
For example, an accounts-payable employee might receive an email that appears to come from a longtime supplier:
"We've changed banks. Please use the attached account information for all future payments."
Everything about the message may look normal. The attacker may even know the name of the supplier and reference a real invoice.
The FBI warns that BEC criminals frequently spoof email addresses and websites, use spear-phishing, compromise legitimate accounts, and study real business communications before making fraudulent requests.
FBI Business Email Compromise guidance
A simple control can prevent a large loss
Financial changes should never be approved solely through email.
Changes to:
- bank account numbers,
- wire-transfer instructions,
- payroll information,
- payment destinations,
- or other sensitive financial information
should be independently verified using a known phone number or another trusted method.
The FBI specifically recommends independently verifying payment and account-change requests rather than relying on the contact information contained in the suspicious message.
4. Baiting
Baiting uses curiosity, convenience, fear, or the promise of something desirable to convince someone to take an unsafe action.
The "bait" could be:
- a free download,
- a supposedly important document,
- a gift or prize,
- a USB drive,
- software,
- a QR code,
- or access to information the victim wants to see.
For example, an attacker might leave USB drives labeled Employee Payroll Information in a company parking lot.
Someone who finds one may be tempted to plug it into a computer to see what is on it.
The attacker is relying on human curiosity rather than defeating a firewall.
Baiting also happens digitally. A fraudulent download might promise a free utility, document template, software update, or other useful resource while actually installing malware or directing the user to a credential-stealing site.
The business lesson
Employees should never connect unknown storage devices to company computers or install unapproved software simply because it appears useful.
Organizations should also have clear policies defining which applications, file-sharing services, removable-media devices, and software sources employees are permitted to use.
5. Tailgating and Physical Social Engineering
Not every social engineering attack happens by email or phone.
Tailgating occurs when an unauthorized person gains access to a restricted area by following an authorized employee inside.
Imagine someone carrying several boxes approaching a locked employee entrance.
An employee holds the door open.
The person says, "ThanksโI left my badge upstairs."
That small act of courtesy may have allowed an unauthorized person into the building.
Attackers may also impersonate:
- delivery personnel,
- contractors,
- equipment technicians,
- cleaning staff,
- job applicants,
- vendors,
- or employees from another location.
Once inside, an attacker could potentially access computers, network connections, documents, employee information, or areas that contain operational equipment.
Preventing physical social engineering
Employees should understand that security procedures still apply even when ignoring them feels impolite.
Visitors, contractors, and vendors should follow established access procedures, and employees should know how to report someone who cannot demonstrate that they are authorized to be in a restricted area.
How to Protect Your Business From Social Engineering
Social engineering is difficult to stop with a single security product because attackers deliberately target people.
The strongest approach combines employee awareness with technical and administrative controls.
Train employees to recognize suspicious requests
Employees should know that social engineering does not always look like an obvious scam.
Warning signs can include:
- unusual urgency,
- unexpected requests for credentials or confidential information,
- requests to bypass normal procedures,
- payment or banking changes,
- unexpected MFA prompts,
- unfamiliar links or attachments,
- requests from executives that do not match normal business processes,
- and people asking for information they should already have.
Employees should also know how and where to report something suspicious.
Verify sensitive requests independently
A request may look legitimate and still be fraudulent.
For financial transactions, password changes, access requests, confidential documents, or other high-risk actions, use a trusted secondary method to confirm the request.
Do not verify a suspicious email by replying to the same email.
Limit access to what employees actually need
Employees should only have access to the systems and information necessary for their jobs.
If an employee account is compromised, limiting that user's permissions can help limit what the attacker can access.
This is one reason principles such as least privilege and network segmentation are important parts of a broader cybersecurity strategy.
Require multi-factor authentication
Passwords are frequently targeted by social-engineering attacks.
MFA creates another barrier when credentials are stolen. NIST notes that when a password is compromised, MFA makes it significantly harder for an attacker to access the account.
For Microsoft 365 environments, our Microsoft 365 MFA setup guide explains the basic process.
Protect email, endpoints, identities, and networks together
Employee training should not be the only defense.
Businesses should combine awareness training with controls such as:
- email filtering,
- multi-factor authentication,
- endpoint protection,
- identity and access management,
- patch management,
- monitoring,
- secure backups,
- appropriate administrative permissions,
- and documented incident-response procedures.
Social engineering may begin with a person, but technical controls can determine whether one employee mistake turns into a much larger cybersecurity incident.
Learn more about how TR Technologies' Managed Security Services help businesses strengthen cybersecurity across users, identities, endpoints, email, networks, and other systems.
Social Engineering and Cyber Insurance
Social engineering risk also matters when businesses evaluate cybersecurity insurance requirements.
Insurers may ask about controls such as MFA, security awareness training, email security, backups, endpoint protection, administrative privileges, and incident-response procedures.
For manufacturing companies, our Manufacturing Cyber Insurance Guide explains the broader security controls commonly considered during the cyber-insurance process.
Social Engineering Is a People Problem and a Technology Problem
Social engineering works because attackers take advantage of normal human behavior: trust, urgency, curiosity, helpfulness, and respect for authority.
The answer is not to expect employees to identify every sophisticated attack perfectly.
Instead, businesses should create an environment where employees know what to look for, know how to verify unusual requests, and can report concerns without hesitationโwhile technical security controls reduce the damage that can occur when someone makes a mistake.
A strong cybersecurity program combines people, processes, and technology so that one convincing phone call, email, text message, or visitor does not become a major security incident.
