The fastest way past a technical defence is to persuade a person to open the door for you. Social engineering is the set of techniques an attacker uses to manipulate someone into revealing information, granting access or performing an action they shouldn't. It doesn't exploit software flaws, but perfectly ordinary mechanisms of human behaviour.
In my work, which combines computing with a background in psychology, I often see that people who fall into these traps aren't naive: they're simply helpful, busy or under pressure. That is exactly why the defence isn't to "be more careful" in general, but to recognise specific patterns.
The most common psychological levers
Almost every social engineering attack combines some of these levers:
- Authority: the requester presents themselves as a manager, a technician, an official. We tend to obey those who appear to hold a role.
- Urgency: "it has to be done within an hour", "otherwise the service will be blocked". Haste reduces critical thinking.
- Reciprocity: a small favour or gift creates a wish to return it.
- Liking and familiarity: it's easier to say yes to someone who seems friendly or knows details of our lives.
- Social proof: "your colleagues have already done it".
- Fear: a fine, a legal problem, a compromised account.
Recognising the lever at work is already half the defence. When you feel you must act immediately to please someone or avoid trouble, stop.
The main techniques
Pretexting
The attacker builds a believable story, the pretext, and uses it to obtain information. For example, they call pretending to be the new supplier of your business software and ask, "for a check", for the name of the system administrator and the times the office is closed. Each piece of information seems harmless; together they prepare an attack.
Baiting
A bait is offered: a USB stick left in the car park labelled "salaries", a free download, a prize. Curiosity or self-interest does the rest.
Quid pro quo
An exchange: "I'm from tech support, we're fixing a network problem, could you confirm your password so I can check?" In return for apparent help, a valuable piece of information is obtained.
Tailgating
Someone carrying a stack of boxes asks you to hold the office door, or follows an employee through the turnstile. Out of politeness, nobody asks who they are.
Gathering information from social media
Before contacting the victim, the attacker studies what's public: job roles, colleagues' names, trips in progress, regular suppliers. A message mentioning your manager's name and the project you're working on immediately seems genuine.
How to defend yourself: simple, workable rules
Verify through a different channel
If someone asks for an unusual action, verify it using a contact you already know, not the one supplied by whoever reached out to you. Call the number in your address book or on the official website, write to the address you normally use.
No exceptions to procedures
Procedures exist precisely for moments of pressure. If the rule says passwords are never shared with anyone, that applies to someone claiming to be the director too. A business that rewards following the rules, even when it slows work down, is much harder to manipulate.
The right to say "I'll call you back"
Make it normal, for yourself and your colleagues, to end a call by saying "I'll call you back in five minutes". A legitimate caller won't mind; a fraudster will insist, and insistence is a warning sign.
Limit what you post about work
Detailed org charts, photos of badges, posts about the owner being "away all week": all valuable material for someone preparing a pretext. Share thoughtfully.
Control physical access
In the office, anyone without a badge is accompanied. Visitors sign in. It isn't distrust, it's a rule that protects everyone, and it can be applied courteously.
An example in a small office
One morning the phone rings: "Good morning, this is Luca from the accounting software support team, we're running an urgent update and I need to connect to your PC. I'll send you a link to install the remote assistance program." The voice is friendly, the tone confident, and the software name is correct. Instead of going ahead, the employee says she'll call back on the support number listed in the contract. She discovers no work had been scheduled. It took one minute.
In short
- Social engineering exploits authority, urgency, reciprocity, liking and fear.
- The most common techniques are pretexts, baits, favour exchanges, tailgating and social media research.
- Always verify unusual requests through a channel you already know.
- Procedures apply even, and especially, under pressure.
- Make it normal to say "I'll call you back" and to accompany anyone without a badge.