Social Engineering
How it works
An attack typically proceeds in phases: reconnaissance (gathering information about the victim and organization), building a pretext and trust (pretexting, impersonating an authority or trusted party), triggering the action (clicking a link, handing over data or funds, granting access), and exiting without raising suspicion. The attacker leverages cognitive biases: deference to authority, time pressure, reciprocity, and curiosity. Vectors include email (phishing), phone (vishing), SMS (smishing), physical contact (tailgating), and bait media (baiting). Increasingly the trust-building phase is augmented by generative AI — deepfake video and cloned voice lend credibility to impersonating a manager or colleague.
Problem solved
Technical safeguards (encryption, authentication, firewalls) do not protect against a human who voluntarily follows an attacker's instructions. Social engineering bypasses technical controls by targeting the victim's trust, urgency, and cognitive biases directly.
Evolution
Kevin Mitnick, Susan Headley and Lewis De Payne use social engineering in phreaking and hacking operations in Los Angeles in the late 1970s and early 1980s.
Mitnick publishes a book codifying social engineering techniques, popularizing the term in the security community.
A targeted spear-phishing campaign compromises RSA SecurID tokens — an example of social engineering as the first stage of an advanced breach.
The CEO of a UK-based energy firm is scammed over the phone into transferring 220,000 EUR; attackers used a synthetic voice — a prominent early AI-augmented social engineering attack.
The firm Arup loses USD 25M after a video call in which every participant except the victim was a deepfake impersonating executives.