Social engineering is the use of deception or manipulation to make a person bypass a security control, reveal information, transfer money, install software, or grant access. The attacker exploits trust, authority, fear, urgency, curiosity, or an ordinary business routine.
Common examples
Phishing messages imitate known organizations. A caller poses as a bank or government agent. A fake technician requests remote access. A criminal follows an employee into a restricted area or persuades support to reset an account.
The underlying technology may work as designed. A payment app can send money correctly, and a real cloud service can host a deceptive form. The false identity and request create the attack.
How to resist social engineering
Slow down and verify through a channel you select. Use established approval processes for payments, password resets, account changes, and sensitive files. Never share one-time codes or install remote-access software for an unexpected caller.
Organizations should make reporting easy and give employees a safe way to pause unusual requests. Training should teach verification, not only spelling-error detection.
Social engineering and phishing
Phishing is one form of social engineering delivered through a message, site, call, or related channel. Social engineering also includes in-person and support-desk manipulation.