What is social engineering?
Social engineering attacks the person rather than the system. It includes phishing emails, pretext phone calls, fake support agents, and SIM swapping. In each case, the attacker uses persuasion to route around a technical control and convince someone to grant access.
- Topic
- Attacks
- Reading time
- 1 min
- Reviewed
On this page
Why it works on careful people
Effective social engineering manufactures urgency and authority, such as a message that appears to come from your bank and says your account will be frozen within the hour. Under time pressure, people stop verifying. The defence is procedural: never act on an inbound message. Start contact yourself through a number or address you already had.
The controls that still hold
Security keys resist phishing because origin binding prevents a fake site from receiving a usable credential. Codes, passwords, and one-time links can still be relayed by an attacker talking to you in real time.
Sources
These primary references support the terminology and current security guidance used in this definition.
