Social engineering refers to the deliberate manipulation of people in order to gain access to confidential information, systems or payments. Social engineering does not exploit technical vulnerabilities, but instead capitalises on trust, a willingness to help, deference to authority and time pressure. The methods used range from fake emails and phone calls to unauthorised access to buildings. Social engineering is considered the most common entry point for cyberattacks.
What is Social Engineering?
Social engineering is the umbrella term for all attacks that target people rather than technology. The attacker persuades their counterpart to carry out an action that the attacker cannot perform themselves – such as revealing a password, opening a door, authorising a bank transfer, opening an attachment or setting up remote maintenance access.
The term originally comes from the social sciences, where it referred to the deliberate influencing of social processes. In information security, it has been established since the 1990s to describe the manipulation of individuals and now covers a broad spectrum: from mass-sent scam emails to relationships built up over weeks, in which a supposed service provider gradually gains trust.
Crucial to understanding this is a reversal of the usual security logic. Technical attacks rely on a fault – a vulnerability, a misconfiguration, a missing update. Social engineering, by contrast, relies on a functioning organisation in which people respond to enquiries, meet deadlines, help colleagues and reply to line managers. These characteristics cannot be patched, nor can they be switched off without rendering the organisation inoperable. This is precisely what makes the method so enduring.
How does a social engineering attack work?
A social engineering attack typically follows four phases, the duration of which varies greatly – from a few minutes in the case of a support call to several weeks for targeted campaigns.
- Information gathering: The attacker gathers information about the organisation, its structure, its service providers, ongoing projects and individual people. Sources include professional networks, legal notices and press releases, job advertisements, tender documents, conference papers and social media.
- Creating a pretext: The information gathered is used to construct a credible scenario – known in technical jargon as a ‘pretext’. The attacker poses as an IT support technician, a new colleague, an auditor, a tradesperson, a supplier, a government official or a customer. The better the pretext fits a real, ongoing process, the less likely it is that the victim will ask for clarification.
- Exploitation: The actual attack takes place, usually by creating a sense of urgency: a deadline approaching, imminent damage, a request for discretion, or a line manager who is supposedly in a meeting and unavailable.
- Withdrawal: The attacker ends the contact in such a way that the manipulation is noticed as late as possible – or not at all – for example, with a plausible explanation, a confirmation email or a suggestion to get in touch again later.
The role of the first phase is particularly noteworthy. The effort lies predominantly in the preparation, not in the attack itself. A phone call that mentions an actual ongoing process, the correct project name and the name of the colleague in charge comes across completely differently from a generic fraud attempt and is rarely questioned.
What psychological principles does social engineering draw on?
Social engineering works because it targets decision-making patterns that make sense in everyday life and are therefore deeply ingrained. The following principles occur both individually and in combination.
| Principle | Effect | Typical application |
| Authority | Instructions from above are less likely to be questioned | Alleged board member, public authority, auditor, head of IT |
| Urgency | Time pressure prevents follow-up enquiries and verification steps | Expiring deadline, imminent suspension, ongoing service disruption |
| Willingness to help | People want to support their colleagues and customers | New employee without access, colleague working from home, emergency |
| Sympathy | Trust is built on shared interests and friendliness | Small talk, mutual acquaintances, shared interests |
| Reciprocity | A favour creates a need to return the favour | A little help to start with, a gift, a supposed solution to a problem |
| Social proof | The behaviour of others serves as a benchmark | “Your colleagues did exactly the same thing yesterday.” |
| Consistency | A small commitment makes the next, bigger one easier | Gradual increase across several contacts |
| Fear | Fear of sanctions stifles critical questioning | Threats of consequences, references to alleged mistakes |
In practical terms, it is important to note that these principles apply regardless of educational background, specialist knowledge or IT experience. They prove particularly effective under time pressure, when the workload is heavy, at the end of a working day, and in situations that are unusual in any case – such as during an ongoing disruption, when every message seems urgent.
What forms of social engineering are there?
Social engineering utilises every channel through which people can be reached – online, by telephone and in person.
| Form | Channel | Description |
| Phishing | Email, instant messaging, social media | Fake messages containing a link, attachment or payment request |
| Vishing | Telephone | A call purporting to be from IT support, a bank, a government department or a line manager |
| Pretexting | Across all channels | A scenario spanning several contacts |
| CEO Fraud | Email, telephone, video | Fake instructions from management regarding payments or the disclosure of data |
| Baiting | Physical, digital | Malicious USB sticks, so-called free offers, tampered downloads |
| Quid pro quo | By telephone, in person | An offer of something in return, such as purported technical assistance |
| Tailgating | Physical | Following authorised persons through secured doors in their wake |
| Impersonation | Physical | Working as a tradesperson, cleaner, delivery driver or inspector |
| Shoulder Surfing | Physical | Reading screens and inputting data on trains, in cafés or in reception areas |
| Dumpster Diving | Physical | Recycling of paper waste, end-of-life electrical and electronic equipment, and data storage media |
Physical methods are regularly underestimated because security measures are geared towards digital attacks. Yet the effort involved is minimal: experience shows that a high-visibility vest, a clipboard and a plausible explanation at reception open more doors than any technical attack. Combinations are particularly effective – a phone call announcing a forthcoming visit is far more convincing than the visit itself.
How does social engineering differ from phishing?
Phishing is a sub-form of social engineering, specifically its digital variant carried out via email, instant messaging or fake websites. Social engineering is the umbrella term and also encompasses telephone and physical attacks, as well as scenarios that unfold across multiple channels and over extended periods of time.
This distinction has practical implications for defence. An awareness programme that focuses exclusively on emails leaves the telephone and physical channels of attack open – and this is precisely where attacks shift when email security is effectively implemented. Similarly, technical safeguards such as spam filters or attachment scanning are effective only in the digital channel. Anyone wishing to tackle social engineering comprehensively must involve reception, site security, the switchboard, specialist departments and senior management – not just IT.
What role does publicly available information play?
Publicly available information is the raw material for any targeted social engineering attack. The systematic analysis of freely accessible sources quickly provides a surprisingly accurate picture of an organisation: names and roles from professional networks, areas of responsibility from press releases, systems and tools used from job advertisements, relationships with service providers from lists of references and contract award notices, address formats from the legal notice, and location details from images.
This also includes information inadvertently revealed. Photos from company parties show ID cards and screen content. Out-of-office messages list stand-ins and return dates. Metadata in published documents contains usernames and file paths. And login credentials from previous data breaches serve as a point of entry or as evidence of credibility.
This cannot be avoided entirely – an organisation must be findable and contactable. Instead, it makes sense to make a conscious decision about which information must be public and which must not. Regular self-assessment from an attacker’s perspective is the simplest way to start and, experience shows, yields more insights than expected.
How are deepfakes changing social engineering?
Artificially generated voices and video footage are blurring the boundaries of what can be accepted as proof of authenticity. From just a few seconds of publicly available material – a podcast, a conference talk, a video message – a voice can be replicated in such a way that it sounds convincing over the telephone. Something similar is possible with video conferences, with quality improving and the effort required decreasing.
This renders obsolete a verification method that has long been regarded as reliable. Calling the supposed sender back remains an effective measure – but only if the call is made via an independently registered number and not via the number given in the message. Nor is personal recognition of the voice or face sufficient as the sole criterion. In a case that came to light in 2024, an employee of an international service provider initiated bank transfers worth millions following a video conference in which several supposed colleagues were synthetically generated.
For organisations, this has a clear implication: checks must be based on processes and independently verifiable channels of contact, not on the perceived authenticity of a person. The question is no longer ‘does that sound like them?’, but ‘is this procedure intended to be carried out in this way, and have I confirmed it via a second, independently chosen channel?’.
Why are technical safeguards against social engineering only of limited effectiveness?
Technical safeguards are only of limited use against social engineering because the attack does not breach any technical rules. An employee who reveals a password, authorises a payment or opens a door is using their legitimate authorisations as intended. To a security system, this looks like normal operation.
Filters, detection systems and access controls therefore primarily serve to shift the attack vector. Good email security shifts attacks to the telephone, messaging apps and face-to-face contact. A well-secured login process shifts them to the support team, which resets access credentials. Even multi-factor authentication does not provide complete protection if attackers request the second factor over the telephone or force it through repeated confirmation requests.
This does not mean we should give up, but rather that we need to shift our focus. What is effective is anything that secures the action itself – processes with checkpoints that operate independently of any single person’s judgement – and anything that shortens the time it takes for an incident to be reported. Technology remains necessary, but it is a framework, not a solution.
How do organisations protect themselves against social engineering?
Effective protection against social engineering is based on three levels: mandatory processes, verifiable checks and a culture that rewards, rather than penalises, asking questions.
Processes
Payment authorisations, changes to bank details and master data, resetting access credentials and setting up remote access must all be subject to a dual-control principle. It is crucial that the rule applies without exception – exceptions for senior management undermine precisely the protection that CEO fraud seeks to exploit. The same considerations apply in physical spaces to visitor management, access control and goods reception.
Verification
The most important single principle is: confirmation must always be provided via a channel not chosen by the person making the request. In practical terms, this means a callback to a number listed in the directory, verification via a second channel owned by the organisation, or personal confirmation. To this end, organisations set up a centrally managed communication channel in which the participants’ identities are sourced from the directory service rather than from sender details – a method that is significantly more difficult to forge than an email address or telephone number, and which also documents who confirmed what and when.
Culture
Regular training is beneficial if it goes beyond email to include the telephone, visitors and data storage media. More important than the detection rate, however, is the willingness to report: a low-threshold reporting channel, a designated point of contact and a reliable assurance that reporting a mistake will not result in sanctions. Anyone who conceals a mistake out of fear is wasting precisely the hours that determine the extent of the damage – for example, when unauthorised access escalates into a ransomware attack. From a regulatory perspective, NIS-2 and ISO 27001 expressly require appropriate awareness-raising and training measures.
How can social engineering tests be carried out in a legally compliant manner?
Social engineering tests – ranging from phishing simulations to physical access attempts – are an effective tool, but they raise issues relating to employment law, data protection and employee participation, and therefore require a clear legal basis.
A written mandate from senior management with a clearly defined scope is required, as is the early involvement of the works council or staff council, as well as data protection and information security officers, and an evaluation carried out exclusively at an aggregated level. An evaluation based on personal data from which behavioural or performance monitoring could be inferred is subject to co-determination and is a sensitive issue under data protection law; it also undermines the objective, as it discourages reporting. Details regarding permissible processing must be included in the documentation on GDPR compliance.
For physical tests, inspectors must also carry written authorisation to rule out criminal offences such as trespass if they are discovered. Limits must also be set: no exploitation of personal hardships, no scenarios relating to health, dismissal or remuneration, and no pressure on individuals. The appropriate metrics are not the click-through rate, but the reporting rate and the time taken until the first report – metrics that measure whether the organisation is responding, rather than simply counting who has ‘stumbled’.
Summary: Key points on social engineering
- Social engineering is the umbrella term for attacks that target people rather than technology – with the aim of obtaining information, access or payments.
- The attack does not breach any technical rules: those affected use their legitimate authorisations, and to security systems it appears to be normal operation.
- There are typically four phases: information gathering, establishing a pretext, exploitation and a discreet withdrawal – the effort lies in the preparation.
- Deeply ingrained decision-making patterns such as authority, urgency, helpfulness, sympathy and reciprocity are exploited.
- Phishing is a sub-form of social engineering; other methods include telephone-based and physical approaches such as vishing, pretexting, tailgating and baiting.
- Publicly available information is the raw material for targeted attacks – conducting your own research from an attacker’s perspective reveals more than you might expect.
- Deepfakes render voices and faces worthless as proof of authenticity; verification must be based on processes and independent channels of contact.
- The most important single principle is verification via a channel not chosen by the person making the enquiry.
- Process rules with no exceptions are crucial: exceptions for senior management remove precisely the protection that CEO fraud seeks to exploit.
- Social engineering tests require written authorisation, co-determination and aggregated evaluation; the key metric is the reporting rate, not the click-through rate.