Social engineering

What it means

Social engineering is a set of manipulation techniques by which an attacker persuades a person to reveal information, grant access or make a payment. Instead of breaking technology, it exploits human trust, helpfulness, authority, time pressure or fear.

The best-known form is phishing by email or text message. Others include phone scams where the attacker poses as the bank or IT support, CEO fraud with an urgent payment request, fake invoices with changed bank details, or physically following an employee into the building.

Attackers often gather information from the company website, social media and public registers. This makes them credible: they know the names of colleagues, suppliers and ongoing projects and can construct a convincing story.

How it works in practice

The main defence is clear rules. For payments, a change of supplier bank account or an urgent request for an instant payment is always verified by phone on a known number, and larger payments need two approvers.

Technically, two-factor login, a password manager and zero trust access, where even internal requests are not trusted automatically, all help. But technology alone is not enough if a person hands the attacker a password or code.

We train our own staff regularly and recommend clients do the same. Most effective are short practical examples of real scams and a simple rule: anyone in doubt stops and checks the request through another channel.

What to watch out for

Attacks target people with access to money or data: accountants, assistants, finance directors. For them the verification rules should be strictest and should not be bypassed even under pressure from a manager.

Social engineering also threatens trade secrets and personal data. A leak of client data may trigger a duty to report the incident under GDPR and damage trust built up over years.