Social Engineering: Hacking People Instead of Systems

The most sophisticated exploit in most breaches is a phone call. Social engineering — manipulating people into granting access, transferring money or revealing information — succeeds against organisations with excellent technical security because it targets the layer no patch fixes. And it has a new accelerant: generative AI can now clone a voice from a few seconds of audio, hold a conversation in real time, and produce a convincing video call. The techniques are old; the tools are not.

The psychology being exploited

Social engineers don't hack emotions at random. They pull on specific, well-documented levers:

• Authority. People comply with someone who appears senior or official — the "CEO" who needs an urgent transfer, the "auditor" who needs credentials.
• Urgency and scarcity. A deadline collapses the time available to think and verify.
• Reciprocity and helpfulness. Support staff and receptionists are selected and trained to help. Attackers request small favours that feel reasonable individually.
• Social proof and familiarity. Referencing colleagues, projects and internal jargon — all available from LinkedIn and press releases — signals belonging.
• Fear and embarrassment. "Your account has been used for something illegal" makes people act to make the problem go away rather than report it.

None of these are character flaws. They are the traits that make organisations function, which is why training people to be suspicious of everyone fails and training them to verify specific things works.

The techniques

• Pretexting. A fabricated scenario and identity — the new IT contractor, the vendor with a billing query, the executive's assistant — built up over one or several contacts to extract information or action.
• Vishing (voice phishing). Calls impersonating IT support, banks or executives. Caller-ID spoofing makes the number look right. Now supercharged by AI voice cloning: in 2024 an employee at engineering firm Arup transferred about $25 million after a video call in which every other participant, including the CFO, was a deepfake.
• Help-desk attacks. Calling the IT service desk as an employee who has "lost their phone" and needs MFA reset. This is how MGM Resorts was breached in 2023, leading to days of casino and hotel outages; the group behind it specialised in fluent, native-English social engineering of support staff.
• Business email compromise. Impersonating executives or suppliers by email to redirect payments — the single most expensive category of cybercrime by reported losses. Covered in Phishing.
• Baiting and quid pro quo. USB drives left in car parks (still works), free software or "prizes" in exchange for credentials, fake job offers that lead to malware — the last a favoured technique of North Korean groups targeting developers.
• Tailgating and physical intrusion. Following someone through a secure door, carrying boxes so they hold it, wearing a hi-vis vest. Physical penetration testers succeed at this at alarming rates.
• Long-con relationship building. Fake recruiter or investor personas cultivated over months on LinkedIn before the ask — used in both espionage and financial fraud.

Who gets targeted

Attackers do reconnaissance and choose. Help desks and support teams, because their job is to resolve access problems. Finance and accounts payable, because they move money. Executives and their assistants, for authority and access. New starters, who don't yet know what normal looks like. Contractors and suppliers, who have access and less training. And increasingly, developers, who hold credentials to production and are approachable through open-source communities and job boards.

Defences that hold

Technical controls limit what a successful manipulation can achieve; process controls make the manipulation fail.

• Verification procedures for consequential requests, written down and mandatory: any change to payment details is confirmed by calling a known number; any MFA reset or password change through the help desk requires identity proof that a phone call can't provide (a manager callback, a video check against a photo, or an in-person visit for privileged accounts).
• Phishing-resistant MFA so that a talked-out password or code is useless — see MFA.
• Separation of duties and payment limits so no single manipulated person can move a large sum.
• Least privilege so a compromised help-desk account can't reset an administrator's credentials.
• Reduce the reconnaissance surface: org charts, direct phone numbers and travel schedules don't need to be public.
• A safe word or challenge for executives and finance teams to use on calls requesting urgent action — low-tech, and effective against voice clones.

Building a culture that verifies

The organisations that resist social engineering share a norm: it is always acceptable to pause and verify, and nobody is ever penalised for doing so. Executives model it by accepting callbacks graciously. Training is realistic — simulated calls and in-person attempts, not just email — and framed around specific scripts ("here's what to say when someone pressures you"). Reporting a suspicious contact is quick and gets a thank-you. And when someone is fooled, the response is to fix the process that let a single person's judgement be the only control, because that is the actual failure.