Social engineering is one of the most deceptive cyber threats out there — not because it exploits software vulnerabilities, but because it exploits people. These attacks use psychological manipulation to trick individuals into sharing sensitive information or performing risky actions. Whether it’s a convincing email from a colleague or a fake tech support call, social engineering preys on human trust, curiosity, and urgency — making it harder to spot than technical hacks. Small and medium businesses are especially vulnerable because attackers know staff are busy, overworked, and often unaware of the risks.
What Is Social Engineering in Cyber Security?
Social engineering in cybersecurity refers to the art of manipulating people to give away confidential information or perform actions that compromise information security. Unlike traditional cyberattacks that target systems, these attacks target human behaviour. The attacker’s goal is to build trust, create urgency, or provoke fear. Each of these can potentially convince someone to click something malicious, divulge information, or act without thinking. Some common targets are: staff in finance or HR, customer support representatives or executives with broad access. It is intended to take advantage of the human element of security.
13 Types of Social Engineering Techniques
You’ve likely heard of a phishing attack, but that is just one of many social engineering attacks that take place. In fact, there are many other common tactics that attackers use to exploit human behaviour. These methods are designed to manipulate and deceive, often catching people off guard. Understanding these strategies is key to identifying and stopping potential threats.
Let’s explore 13 of the most common types of social engineering attacks. To make things easier, we’ve grouped them into categories based on how they’re delivered or the type of manipulation they rely on.
These cybercrime attacks fall into three main groups: messaging-based, psychologically manipulative, and opportunistic tactics.
Email & Messaging Based Attacks
1. Phishing
Phishing emails are one of the most common forms of social engineering. It involves deceptive messages, most often as emails, that trick users into revealing sensitive information, such as passwords or payment details. These messages usually impersonate trusted organisations like banks, cloud platforms, or government services. They often create a sense of urgency or fear to prompt a quick response before the recipient has time to think critically.
Example:
An employee receives an email that appears to come from Microsoft 365, warning that their account has been suspended due to suspicious activity. The message includes a link to a fake login page. If the user enters their credentials, the attackers capture them instantly.
2. Spear Phishing
Spear phishing is a targeted version of phishing. Instead of sending mass emails, attackers craft personalised messages aimed at a specific person, often using publicly available details from LinkedIn or company websites. The messages appear credible and relevant, making them difficult to detect, especially for busy employees.
Example:
A finance manager receives an email that seems to be from their CEO, referencing a real client and asking for an urgent wire transfer to secure a new deal. The sender address is spoofed, and the request looks legitimate due to insider details.
3. Whaling
Whaling is a type of phishing that specifically targets high-level executives or key decision-makers. These attacks often mimic legal or financial requests and may involve fake subpoenas, invoices, or tax documents. Because senior leaders may have broader access to systems and sensitive data, a successful attack can be especially damaging.
Example:
A company director gets an email that appears to be from HMRC, warning of overdue taxes and including a link to a document requiring urgent review. The link installs malware that compromises the executive’s credentials.
4. Business Email Compromise
Business Email Compromise (known as BEC) is a high-risk attack where a cybercriminal gains access to a legitimate business email account, often through phishing or credential theft. Once inside, they monitor account information, communications, learn internal processes, and eventually send fraudulent messages to deceive staff into transferring money or sharing sensitive data. Because these emails come from a real account, they often bypass security filters and appear fully trustworthy. Like other attacks, the truck users into making security mistakes or giving away business critical information.
Example:
An attacker gains access to the CEO’s email account and waits for an opportunity. During a supplier renewal cycle, they email the finance team with updated bank details—posing as the CEO and referencing the actual contract. The payment is sent, and the fraud is only discovered weeks later.
5. Email Spoofing / Impersonation
Spoofing occurs when attackers forge an email header to make it appear as though it came from a trusted domain or email address—even though they don’t have access to the real account. This is only possible when businesses haven’t properly configured SPF, DKIM, and DMARC records. Attackers may also use typo-squatting, registering domains that look almost identical to yours to impersonate trusted contacts (e.g., replacing an “m” with “rn” or adding a hyphen).
Example 1:
An email shows finance@your-company.co.uk in the “From” field but was actually sent from a rogue server. Because email authentication wasn’t enforced, the spoofed message was delivered.
Example 2:
An attacker registers your-cornpany.co.uk and sends emails from finance@your-cornpany.co.uk. The visual similarity tricks staff into thinking the email is legitimate.
6. Smishing
Smishing uses SMS or messaging apps to deceive recipients. The messages usually contain a link or request for personal information, disguised as alerts from banks, delivery services, or IT providers. With mobile phone use on the rise, smishing is becoming more common.
Example:
A staff member receives a text claiming to be from Royal Mail, asking them to pay a small customs fee to release a package. The link leads to a fake payment page that captures card details.
7. Vishing
Vishing (voice phishing) involves phone calls or voicemails from attackers pretending to be from trusted organisations. The goal is to build rapport quickly and extract sensitive information such as login credentials, payment info, or security codes.
Example:
A caller poses as an IT support technician from the company’s helpdesk, warning about unusual activity on the employee’s computer. They ask the staff member to install “diagnostic software,” which is actually remote access malware.
Psychological Manipulation Attacks
8. Pretexting
Pretexting involves creating a false scenario to trick someone into giving up information or access. The attacker may pose as someone with authority, such as a bank officer, supplier, or internal staff member, and ask for sensitive data under a believable pretense.
Example:
A hacker can call pretending to be from the IT department, claiming they need to verify login details to complete a routine system upgrade. The employee, trying to be helpful, provides their credentials.
9. Quid Pro Quo
In quid pro quo attacks, the attacker offers something in return for information or access, often posing as a support technician, vendor, or service provider. Unlike baiting (see below), this approach involves direct interaction.
Example:
A fake IT support technician offers to fix “slow internet” for a user. They ask for login credentials to “run diagnostics,” then use those credentials to access internal systems.
10. Honeytrap
Honeytrap attacks rely on fake romantic or social relationships to gain trust and access. These scams often start on dating apps or social media, slowly building rapport before asking for money or information.
Example:
An employee begins chatting with someone on LinkedIn who claims to work in the same industry. Over time, the attacker asks them to share confidential pricing data or download a “presentation” that contains spyware.
Curiosity or Greed-Based Attacks
11. Baiting
Baiting offers something tempting—like free music downloads, discounts, or even USB drives—in exchange for the victim’s interaction. The bait usually contains malware or leads to a malicious website.
Example:
A USB stick labelled “Payroll Data” is left in a car park outside an office building. An employee plugs it into their laptop out of curiosity, unknowingly triggering malware that grants remote access.
12. Rogue Software (Scareware)
Rogue software attacks trick users into believing their computer is infected. They prompt users to download fake antivirus tools or pay to “clean” their device, when in fact they’re installing more malware.
Example:
A pop-up appears on a staff member’s screen saying, “Warning: Your PC is infected! Download antivirus now.” The download installs a keylogger instead of fixing anything.
Disruption & Redirection Attacks
13. Diversion Theft
Originally a physical scam, diversion theft has evolved into a digital tactic where attackers reroute information or payments by impersonating trusted contacts or manipulating logistics.
Example:
An attacker sends a fake email from a supplier, updating their bank details for future payments. The company updates their records, and the next invoice is paid into the attacker’s account.
How To Recognise Social Engineering Attacks?
Social engineering tricks you by playing on emotions like fear, urgency, or curiosity. If something feels off, it probably is.
Watch out for:
- Messages that pressure you to act fast
- Requests for passwords, money, or sensitive info
- Emails or calls from people you weren’t expecting
- Links that look strange or lead to unknown websites
- Spelling mistakes or odd language
If you’re unsure, don’t click. Double-check with the sender directly.
How To Prevent Social Engineering Attacks?
You can’t stop every social engineering scam, but you can make them easier to spot and harder for the attackers to succeed. Preventing social engineering means combining three things:
- Smart habits — knowing what to look for and thinking before you click
- The right tools — like email security, password managers, and MFA
- Clear rules — so everyone in the business knows how to handle sensitive requests
These attacks target people, not systems — so the best defence is educating your team and using effective protections that reduce risk without adding unnecessary complexity.
Practical Security Tips
Here are three simple, high-impact ways to strengthen your defences:
- Block suspicious emails before they reach your inbox
Most social engineering starts with email. Use a robust email security solution that filters out phishing attempts, blocks spoofed senders, and flags suspicious attachments or links. Don’t rely on built-in filters alone, as they miss more than you think. - Use strong, unique passwords — and store them securely
Don’t reuse passwords or rely on date of birth, or pet names. A password manager helps create and store strong passwords so your team doesn’t have to remember them. - Turn on Multi-Factor Authentication (MFA)
MFA adds an extra layer of protection — usually a code from your phone — so even if a password is stolen, attackers can’t get in. - Keep devices and software up to date
Make sure antivirus tools, operating systems, and mobile devices are regularly updated. Security patches fix flaws that attackers are quick to exploit. Avoid public Wi-Fi unless you’re using a VPN or a good security tool.
Team Habits That Help
Remember, technology helps, but your people are the first line of defence. Encourage these habits:
- Don’t click without thinking
If you get an unexpected email, link or attachment, especially one that creates urgency, please pause. Hover over links to check where they lead. When in doubt, don’t click. - Stay alert to social manipulation
Scammers build trust over time. If someone you’ve only met online starts asking for sensitive information, money, or access, it could be a scam. Be cautious, especially on LinkedIn, WhatsApp or social media. - Follow normal approval processes
Social engineering often relies on getting people to bypass normal checks. If a request feels rushed, unusual, or asks you to “keep it quiet,” speak up, even if it looks like it came from someone senior.
Physical Security: What to Watch For?
Social engineering doesn’t just happen online. Attackers can take advantage of physical situations too — especially when devices or offices are left unprotected.
- Lock your devices
Always lock your laptop or phone when stepping away, even if it’s very briefly. Use automatic screen locks and keep devices stored safely when not in use. - Avoid public Wi-Fi — or use a VPN
Public Wi-Fi makes it easy for attackers to intercept your data. If you must connect, use a VPN to encrypt the connection. - Watch for tailgating or impersonators
Be cautious of people trying to follow you into secure areas, or claiming to be “IT support” without proper ID. Always verify who they are, especially in shared offices or co-working spaces.
Social Engineering Defences
Protecting your business from social engineering tactics takes more than antivirus software. You need a combination of strong access rules, well-trained staff, and smart technology. These layers work together to stop threats early and help your team respond confidently when something feels off.
Access Control Policies
Social engineers often try to trick staff into doing something they shouldn’t. You can reduce the risk by limiting access to sensitive systems and data.
- Use multi-factor authentication (MFA) on email and admin accounts
- Apply the principle of least privilege. Staff should only access what they need
- Avoid trusting people by default, and always verify unusual requests
Security Awareness Training
Most social engineering relies on human error. Training your staff helps them pause, question, and avoid falling for scams.
- Show real examples of phishing, fake invoices, and impersonation
- Teach them to slow down, check links, and verify requests
- Make reporting suspicious emails or messages quick and easy
Cybersecurity Technologies
Technology can help stop attacks before your team even sees them.
- Email security tools block phishing, spoofing, malware and catch common scams
- Device security protects your computers and mobile devices from cyber attack
- Software updates fix known weaknesses
- Monitoring tools alert you to suspicious activity
These tools are most effective when combined with training and clear policies.
Stay One Step Ahead of Social Engineering
Social engineering attacks don’t need advanced hacking tools — just one distracted click, a bit of trust, or a rushed decision. That’s why the best defence isn’t just software — it’s awareness, access control, and the right support.
If your business relies on email, handles payments, or stores sensitive data, now’s the time to make sure your defences are in place. With the right tools and a bit of training, your team can spot the warning signs before it’s too late.
FAQs
What is the most important factor in avoiding social engineering attacks?
The best way to prevent social engineering is to help people recognise it. These attacks don’t break into systems, they trick people into giving access away. Awareness training, backed by strong policies and tools, makes a big difference.
Why is a social engineering attack so difficult to defend?
Because they target human behaviour, not technology. Even people who know better can be caught off guard when they’re busy, pressured, or tired. That’s what makes social engineering so effective, and also why prevention must involve people, not just software.
Why do social engineering attacks often start with emails or messages?
Because email, SMS and messaging apps are easy ways for attackers to reach people. A message can be made to look like it’s from your bank, your boss, or a supplier. If someone clicks without checking, the attacker is in.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
