Social engineering

Social engineering is the manipulation of people to obtain access, data or a payment: the attacker goes after the person operating the system rather than the system itself. Technology plays a supporting role at most, the pivot is trust.

What it means

The foundation is the pretext, the invented story in which the attacker plays a role that calls for cooperation. A new hire who has lost their phone, a supplier chasing an urgent invoice, someone calling on behalf of a board member. Two levers are then applied: authority, which makes pushing back feel awkward, and urgency, which makes it seem there is no time to check anything. Both serve the same purpose, skipping the normal control.

Two routes deserve particular attention. The first is the service desk. An attacker who imitates an employee convincingly enough can have a password reset or a method for multi-factor authentication (MFA) enrolled on a new device, and then holds fully legitimate access rather than a stolen password. The second is MFA fatigue: an attacker who already has the password sends push prompts until the victim dismisses one, sometimes accompanied by a call from the supposed help desk to explain the prompts away.

Why it matters

There is no patch for a convincing phone call, and awareness alone does not hold up against someone who has rehearsed their story. What does work is process. Write down which actions are sensitive, such as a password reset, a new MFA enrolment or a changed bank account, and allow them only after verification through a second, known channel. Make the verification itself robust: confirmation by the person’s manager or a registered passkey is stronger than a date of birth or an employee number, because details like those are often already in a breach dump. Give staff the explicit right to take that step every time, including with an executive on the line. Add a reporting culture on top: someone who says they nearly fell for it deserves thanks rather than blame, because a fast report is often the difference between an incident and a breach.

Example

The group known as Scattered Spider shows how far this reaches. At several large organisations the attackers called the service desk, posed as an employee and asked for a password reset and for a new MFA method to be enrolled. In those cases the access came through the front door, with legitimate accounts, and no software vulnerability was needed. The FBI and CISA describe this pattern in a joint advisory.