Social Engineering Explained: How Attackers Trick People

What is social engineering?

Social engineering is hacking people, not computers. Instead of breaking a password, the attacker manipulates a person into handing over access, information or money — by pretending to be someone trustworthy, creating panic, or offering something tempting. Phishing messages are the most famous example, but social engineering is the bigger family that phishing belongs to. Once you see the patterns, the same tricks stop working on you.

Trick 1 — Authority: “I am from IT / the bank / your university”

People obey people who sound official. A caller claims to be from IT support, a bank's fraud team, or a courier company, and asks you to “verify” your account or install a remote-access app. Real support teams never ask for your password or one-time code, and a job title on a phone call proves nothing — anyone can claim one.

Trick 2 — Urgency: “Act now or lose everything”

“Your account closes in 2 hours”, “a payment is leaving your account now”, “your parcel will be returned today”. Urgency is designed to switch off your thinking. The defence is simple and always the same: slow down on purpose. A genuine emergency will still be there after you verify it through an official channel.

Trick 3 — Trust and pretexting: a believable story

Pretexting means inventing a scenario: “I am a new colleague and I locked myself out”, “I am doing a survey for your university”, “your friend recommended you”. The story feels normal, so the request feels normal too. Ask yourself: would this person really need this information from me, through this channel, right now?

Trick 4 — Baiting: something free, something tempting

A free gift, a prize you never entered for, a “free” USB drive left in a car park, a download link for paid software. The bait carries malware or leads to a fake login page. The rule is old and still true: if you did not enter, you did not win; if it looks too good to be true, it is the hook.

Trick 5 — Tailgating: following someone through a locked door

In offices and hostels, an attacker simply walks in behind an authorised person — “could you hold the door, my hands are full?” — or borrows a visitor badge. It sounds polite to help, but secure doors exist for a reason. The professional response is friendly and firm: “Sorry, you will need to sign in at reception.”

Trick 6 — Quid pro quo: a favour in exchange for access

“I will fix your slow computer if you give me your login”, “complete this survey and get free data”. A small favour makes the request feel fair. Real IT help never needs your password — a technician can reset access without ever knowing it.

The defence routine that beats all six tricks

• Stop. Do not act, click, share or hand anything over while you feel rushed or flattered
• Verify independently. Hang up and call the official number from the card, app or website — never the number inside the suspicious message
• Check the channel. Would your bank, university or IT team really ask for this, in this way? If not, it is the trick
• Never share secrets. Passwords, PINs, one-time codes and full card numbers are never shared, with anyone, for any reason
• Report it. Use the app's report option, tell your IT team, and warn family — the same trick is usually tried on many people at once

Practice task (30 minutes)

Write down three social-engineering attempts you have seen — a suspicious call, message or “too good” offer, real or invented for practice. For each one, name the trick (authority, urgency, trust, baiting, tailgating or favour), the exact words that gave it away, and what the safe response would have been. Then teach the STOP–VERIFY rule to one family member, because attackers target the least prepared person in a household first.

Common mistakes to avoid

• Trusting a caller because they know your name — names leak in data breaches every day
• Being too polite to hang up or refuse a door — politeness is the attacker's tool
• Verifying through the attacker's own link or phone number
• Thinking “I am too smart for this” — these tricks work on professionals too, which is why the routine matters more than confidence