[Link: Verify your account here: malicious-amazon-login.com] Failure to verify your account within 24 hours will result in account suspension.
Social engineering is a trick used to fool people into giving away private information or doing something they shouldn’t, usually by pretending to be someone they're not in order to gain the trust of their victim(s).
1. Phishing
Fake emails, texts, or messages that look legitimate but trick you into clicking links, downloading malware, or entering personal info.
Example: You get an email that looks like it’s from your bank, asking you to “verify your account.”
2. Vishing (Voice Phishing)
Phone calls where someone pretends to be from tech support, a bank, or government agency to get sensitive info.
Example: “This is Microsoft. We’ve detected a virus on your computer…”
3. Smishing (SMS Phishing)
Phishing via text messages. Usually includes a suspicious link or urgent message.
Example: “Your package is delayed. Click here to reschedule delivery.”
4. Pretexting
The attacker creates a fake identity or situation (a “pretext”) to get you to trust them and share info.
Example: Someone pretends to be HR asking for your Social Security number to “update your file.”
5. Impersonation
The attacker pretends to be someone you know or someone in authority (like a boss or IT support).
Example: A “CEO” emails asking you to urgently wire money for a business deal.
6. Baiting
Luring someone with a tempting offer—like free software, a USB drive, or music downloads—that actually contains malware.
Example: A USB drive labeled “Employee Salaries” left in a company parking lot.
7. Tailgating / Piggybacking
Physically following someone into a restricted area by pretending to be an employee or visitor.
Example: “Oops, I forgot my badge—mind holding the door?”
8. Quid Pro Quo
Offering a service or benefit in exchange for information.
Example: “I’ll fix your printer if you give me your login credentials.”
These methods all rely on exploiting human trust, fear, curiosity, or helpfulness—not just technology. That’s what makes social engineering so powerful and dangerous.
Target: An employee at a company
Attacker’s Goal: Gain login credentials to the company’s internal system
Pretext (The Setup)
The attacker calls the employee pretending to be from the company’s IT department."Hi, this is Mike from IT. We’re doing urgent maintenance on the login system, and I noticed your account has been flagged."
-
Creating Urgency and Trust
The attacker uses technical jargon and time pressure."If we don’t fix this now, your access could be locked and flagged for audit. I can help you reset it quickly."
-
Information Gathering
The attacker asks a few harmless-seeming questions to gather details:"Can you confirm your username and the last four digits of your employee ID?"
-
Exploitation
Then comes the real request:"Now I just need your current password to manually reset the system on our end. After that, I’ll send you a temporary one."
-
The Hook
The employee, stressed and believing they’re helping IT, provides the password. -
Execution
The attacker immediately logs into the employee's account and accesses sensitive company data or plants malware.
What just happened? The attacker didn’t hack any system—they hacked human trust. That’s social engineering in real time: manipulating someone into voluntarily giving up secure information.
Have you ever had this happen to you? I'll bet it has but you didn't know it.
So, what can you do to protect yourself? Turns out there are a number of things you (or your company) can do to prevent (or, at least, delay the inevitable attack), like:
Recognize the warning signs
- Unexpected phone calls. If you get a call you weren’t expecting, especially if the caller says they’re from a bank, insurance, or an IT company, chances are it’s a phishing attempt.
- Suspicious email sender’s address. If something feels off about an email you got, always check the sender’s email address because it may be a spam email.
- Unusual requests from someone that you may know. If your boss or a manager contacts you with urgent requests for money, credentials, documents, and other information when they've never done that before, it could be a phishing attempt. Always verify.
- Urgent requests or demands. Phishing attempts have a sense of urgency to them, such as “pay now” or “act quickly,” all designed to make you feel pressured, distracted, and overwhelmed into acting NOW!
- Unexpected links or attachments. Do not open attachments or click on links in emails you were not expecting. They could be malicious, and lead to dangerous sites.
- Unusual layout and spelling. Incorrect grammar and spelling, strange sentence structure, and inconsistent formatting are strong indicators of a phishing attempt.
- Generic greetings/signature. Greetings that don’t include your name, such as “Sir/Maam,” and signatures without contact information (or contact information that does not make sense) are strong indicators of a phishing email.
- Offers that seem too good to be true. If an offer seems too good to be true, such as large amounts of money for seemingly useless information, it could be a phishing attempt.
- Requests on social media from someone you don’t recognize. Be wary of messages from people or entities you don’t know.
Implement multi-factor authentication
Multi-factor authentication, specifically phishing-resistant MFA, is a security method that requires users to verify their identity using two or more different types of proof, like a password and a code sent to your phone. The requirement of two or three extra steps lowers the risk of a breach even if attackers already have your credentials.
Train employees on awareness
Regular organization-level training is important to ensure the safety of your employees and data. Employees should be informed about and be taught to use defensive measures such as multi-factor authentication, the importance of the use of strong passwords, and the use of firewalls.
Operate under the zero-trust mindset
Essentially, don't trust anyone. Always assume all incoming communications are social engineering attempts, and proceed with caution. Always be looking for clear evidence that the message is legitimate.
Avoid sharing personal information online
Monitor your social media profiles keeping them private and ONLY share access with people you know personally.
