Social Engineering: Types, Warning Signs, and Safe Verification

What is social engineering?

Social engineering is the use of deception, impersonation, and psychological pressure to persuade someone to reveal information, grant access, send money, or perform another unsafe action. Instead of defeating a technical control directly, the attacker tries to make an authorized person bypass it.

Social engineering can happen by email, text, phone, video call, social media, support chat, a fake website, or in person. It can target anyone, including customers, executives, help-desk staff, finance teams, developers, and third-party suppliers.

Common types of social engineering attacks

One attack can use several types. An attacker may send a text, move the target to a phone call, use a fake support portal, and then request an MFA approval.

How a social engineering attack works

1. Research: the attacker gathers names, roles, suppliers, travel, projects, relationships, and communication style from public or stolen information.
2. Pretext: they create a plausible reason for contact, often tied to routine work or a recent event.
3. Pressure: urgency, authority, fear, curiosity, sympathy, secrecy, or a promised reward reduces the chance that the target verifies the request.
4. Action: the target is asked to click, sign in, run a file, read a code, approve MFA, change payment details, disclose data, or open a door.
5. Follow-on: the attacker uses the access or information, hides activity, and may impersonate the victim to reach others.

Warning signs that matter

• An unexpected request changes normal procedure or asks for an exception.
• The sender creates urgency, secrecy, fear, or pressure not to consult anyone.
• A caller asks for a password, recovery code, MFA code, or approval of a prompt they initiated.
• Payment or bank details change shortly before a deadline.
• The sender address, reply-to, domain, phone number, or link does not match the claimed identity.
• A request moves between channels: email to text, QR code to phone, or support call to remote-access tool.
• The person knows some real details but cannot pass the organization's established identity check.
• A file or website asks you to disable protection, ignore a warning, enable content, or install an unknown tool.
• Someone without a badge or escort relies on politeness to enter a restricted area.

Good grammar, a familiar caller ID, an existing email thread, a recognizable face, or a matching voice is not proof. Accounts and threads can be compromised, phone numbers can be spoofed, and synthetic audio or video can imitate a known person.

A safe verification process

1. Pause the requested action. Urgency created by the requester is a reason to verify, not a reason to skip verification.
2. Use a separate trusted channel. Call a saved number, open the service from a bookmark, or contact the person through an established company directory. Do not use contact details supplied in the suspicious request.
3. Verify both identity and authority. A real colleague may still lack authority to approve a payment, disclose data, reset MFA, or add a new administrator.
4. Check the transaction itself. Confirm the recipient, amount, destination, account change, requested data, and business purpose.
5. Follow the process even for senior people. Dual approval, call-back, access review, and visitor controls should not disappear because a request claims to come from an executive.
6. Report the attempt. A message that reached one person may be part of a wider campaign.

A secret phrase can help in some personal situations, but it should not replace an established verification process and must not be shared in the same compromised channel.

What to do if you responded or took action

Report quickly even if you are unsure. Hiding a mistake gives an attacker more time. Organizations should make reporting easy and non-punitive so people escalate suspicious interactions early.

How organizations can prevent social engineering

• Require independent verification and dual approval for payments, bank-detail changes, sensitive exports, and privileged access.
• Give help-desk staff an identity-proofing process that does not rely on facts an attacker can find online.
• Use phishing-resistant MFA where possible and protect enrollment, recovery, and device-registration workflows.
• Apply least privilege, short-lived access, separation of duties, and rapid session revocation.
• Filter email, web, text, and collaboration threats while assuming some attempts will get through.
• Train with role-specific scenarios, then test the process rather than blaming individuals.
• Add clear external-email, unusual-sender, and payment-change cues without training users to trust banners blindly.
• Make reporting available from email and messaging tools and connect reports to rapid campaign-wide search.
• Control visitor access, badges, escorts, deliveries, and removable media.
• Prepare playbooks for credential theft, fraudulent payment, remote-access abuse, and impersonation.

AI, deepfakes, and voice cloning

AI can make lures more polished, personalize them at scale, and imitate voices or faces. Visual glitches, odd pauses, and unnatural speech may occur, but they are unreliable defenses. For sensitive actions, treat audio and video as communication channels, not identity proof. Confirm through an independent channel and the same approval process used for any other request.

References

• Canadian Centre for Cyber Security: Social engineering
• Europol: Social engineering - when trust is exploited