Social engineering
Also called human hacking, pretexting
Social engineering is the manipulation of people into giving away access, information or money. Instead of breaking technical defences, attackers exploit trust, fear, urgency or authority. Common forms include phishing emails, phone calls posing as a bank or IT help desk, fake invoices and impersonation of senior executives, increasingly with deepfake voice or video.
How it works
An attacker first researches the target using public profiles, leaked data and company websites. They then build a believable pretext, such as a supplier changing bank details, a fraud team warning of a compromised account or a chief executive needing an urgent transfer. Contact comes by email, text, phone or video. The attacker applies pressure so the target acts before checking, by sharing a passcode, resetting a password or sending a payment.
Against staff, firms run regular awareness training and phishing tests, require call-back checks on payment and bank detail changes and tighten help desk identity checks before resetting credentials. Against customers, banks issue warnings during payments, use confirmation of payee and look for signs of coaching. Strong multi-factor authentication limits damage when a password is given away, though attackers also target one-time passcodes.
The rules
Expects risk-based authentication and layered security, including training call centre and help desk staff to recognise social engineering and educating customers about phishing.
US banks, credit unions and their service providersRequires at least annual cybersecurity awareness training for all personnel that includes social engineering.
Banks, insurers and other entities licensed by the New York Department of Financial ServicesRequires firms to reimburse customers manipulated into sending authorised push payments to fraudsters, giving banks a direct cost when social engineering succeeds.
Payment firms sending and receiving Faster PaymentsCommon questions
Is phishing the same as social engineering?
Phishing is one type of social engineering, carried out by email. Others include vishing by phone, smishing by text, pretexting and impersonation in person or by video.
Why do attackers target help desks?
A help desk can reset passwords and register new devices. Persuading an agent to do so gives the attacker access without needing to break any technical control.
Does multi-factor authentication stop social engineering?
It reduces the damage from stolen passwords, but attackers also trick people into sharing one-time codes or approving prompts. Phishing-resistant methods and strong help desk checks close those gaps.
