What Is Social Engineering? Hacking the Human

What Is Social Engineering?

Social engineering is the use of psychological manipulation to deceive people into revealing confidential information, granting access, or performing actions that undermine security. Unlike technical attacks that exploit software vulnerabilities, social engineering exploits human vulnerabilities — trust, fear, curiosity, authority, and urgency.

Security experts often say: "The weakest link in any security system is the human being." Social engineering is the attacker's primary tool for exploiting that weakness.

Why Social Engineering Works

Attackers exploit well-known psychological principles:

| Principle | How Attackers exploit It | |-----------|--------------------------| | Authority | "This is IT support / your manager / HMRC" | | Urgency | "Act now or your account will be closed" | | Fear | "You owe £800 in unpaid taxes — police are coming" | | Trust | "I'm your colleague Sarah from the Dubai office" | | Reciprocity | "I helped you last week, now I need your password" | | Social proof | "Everyone else in the department has already approved this" | | Curiosity | "USB stick found in car park — what is on this?" |

Common Social Engineering Attacks

1. Phishing and Its Variants

The most widespread form — sending deceptive emails, texts (smishing), or calls (vishing) to steal credentials or install malware.

2. Pretexting

The attacker creates a fabricated scenario (pretext) to gain the victim's trust and extract information.

Example: > Attacker calls the HR department: "Hi, this is James from IT security. We have detected unusual activity on employee account sarah.jones. Can you verify her employee ID and date of birth so we can lock the account before any data is lost?"

The attacker now has information for identity theft or further attacks.

3. Baiting

The attacker leaves something enticing for the victim to pick up — often a USB drive loaded with malware, left in a car park, reception, or toilet.

When curiosity wins and the victim plugs in the drive, malware installs automatically.

Real case: A 2016 study dropped 297 USB drives across a university campus. 98% were picked up; 45% had files opened within hours.

4. Quid Pro Quo

The attacker offers something in exchange for information or access.

Example: > Someone calls employees pretending to be IT support: "We're doing free computer optimisation today. Just give me your password and I'll run the tune-up remotely."

5. Tailgating (Piggybacking)

The attacker physically follows an authorised person through a secured door without credentials — exploiting politeness ("hold the door").

Example: An attacker in a delivery uniform carries large boxes and asks an employee to swipe them through a badge-protected door.

6. Watering Hole Attack

Instead of targeting victims directly, the attacker compromises a website frequently visited by the target group (industry forums, supplier portals). When targets visit, malware is delivered.

7. Business Email Compromise (BEC)

The attacker impersonates a senior executive or supplier to manipulate employees into transferring funds or revealing sensitive data.

From: [email protected]  (not the real CEO domain!)
To: [email protected]
Subject: Urgent wire transfer needed

Please transfer £125,000 to the following account by 3pm today.
This is time-sensitive. Do not discuss with anyone else.

BEC caused over $50 billion in losses globally between 2013–2022 (FBI IC3 data).

Social Engineering in Penetration Testing

Ethical hackers (penetration testers) use social engineering as part of assessments:

• phishing simulations — send fake phishing emails to measure click rates
• vishing tests — call employees to see if they disclose sensitive info
• Physical intrusion — attempt to tailgate or bluff entry to facilities
• USB drop tests — leave benign USB drives to measure pickup rates

Results are used to guide security awareness training.

Real-World Examples

| Incident | Method | Impact | |----------|--------|--------| | Twitter hack (2020) | vishing — called Twitter staff, obtained system access | 130 accounts hijacked including Obama, Biden, Musk | | RSA SecurID breach (2011) | phishing email titled "2011 Recruitment Plan" | Seed data for RSA tokens stolen | | Kevin Mitnick | Pretexting, impersonation | Hacked dozens of companies using pure social engineering | | Ubiquiti ($47M fraud, 2015) | BEC — impersonated executive to transfer funds | $47 million wired to attacker accounts |

How to Defend Against Social Engineering

For Individuals

• Verify identity — always call back on a known number, not the one provided
• Slow down — urgency is a red flag; take time to verify
• Follow security procedures — never bypass them for convenience
• Report suspicious contacts — even if you did not fall for it

For Organisations

• Security awareness training — regular, engaging, scenario-based
• phishing simulations — measure and improve employee resilience
• Verification procedures — callback verification for wire transfers and sensitive requests
• Need-to-know access controls — limit what any one person can authorise
• Clear escalation paths — make it easy to report suspicious contacts
• Policies for out-of-band requests — wire transfers must follow multi-step approval

Quick Recap

• Social engineering manipulates people rather than breaking technology
• It exploits psychological principles: authority, urgency, fear, trust, curiosity
• Common attacks: pretexting, baiting, tailgating, BEC, quid pro quo
• The best defence is security awareness training combined with strong verification procedures
• Technology controls alone cannot stop social engineering — the human layer must be hardened