None

What is Social Engineering?

Think of it like a con artist, but online (or sometimes in person). Instead of breaking through your security, they trick you into opening the door yourself.

Simple definition: Manipulating people into giving away information or access they shouldn't.

Why bother cracking passwords when you can just… ask for them?

It sounds dumb, but it works way more often than it should. People are helpful by nature. We trust others. We want to be polite. Attackers exploit exactly that.

Why Does This Work So Well?

Humans are predictable. We all have the same psychological triggers:

Authority — Boss says jump? We jump. Attackers pretend to be bosses, IT support, or anyone in charge.

Urgency — "Your account will be locked in 5 minutes!" Panic makes us skip the thinking part.

Fear — Nobody wants to get fired or lose money. Threats work really well.

Curiosity — "See who viewed your profile!" Yeah, you're clicking that.

Helpfulness — We like helping people. It feels good. Bad guys know this.

Greed — "You've won $1000!" Sure, it's probably fake, but what if…?

I've fallen for some of these myself. We all have. The key is learning to recognize them.

The 10 Most Common Tricks (And How to Beat Them)

1. Phishing Emails

What it is: Fake emails pretending to be from your bank, Amazon, your boss, whoever.

Real example I received:

`From: security@paypa1-support.com Subject: URGENT: Your Account Has Been Locked

Dear Valued Customer,

We detected suspicious activity. Click here NOW to verify your identity or your account will be permanently suspended.

[Sketchy Link]`

How it works:

  • Looks kinda official (but not quite)
  • Creates panic
  • Demands you click immediately
  • Hopes you don't look too closely

How to spot it:

  • Sender email looks weird (paypa1 instead of paypal)
  • Generic greeting ("Dear Customer")
  • Grammar mistakes
  • Hover over links — they go to random sites
  • Creates fake urgency

How to protect yourself:

  • Check the actual email address, not just the name
  • Hover over links before clicking (don't actually click)
  • When in doubt, go directly to the website (don't use their link)
  • Turn on two-factor authentication (MFA) for everything important
  • If it feels wrong, it probably is

2. Spear Phishing

What it is: Phishing, but personal. They know your name, your job, your boss's name.

Real example:

`From: john.smith@yourcompany.com Subject: Updated Q4 Report — Need Your Review

Hey Sarah,

Can you check this updated budget spreadsheet? Boss wants it before tomorrow's meeting.

Thanks! John

[Attachment: Q4_Budget_FINAL.xlsx]`

Why it's dangerous: This looks completely real. They got your info from LinkedIn, company website, maybe Facebook. It mentions actual projects, real people, upcoming meetings.

How to protect yourself:

  • If someone asks for something unusual, verify through another method (call them, Slack them)
  • Be careful what you post on social media about work
  • Check if requests make sense (would John really email this on Sunday at 2am?)
  • When in doubt, pick up the phone

3. Pretexting

What it is: They make up a whole story to trick you.

Real example: "Hi, I'm Mike from IT. We're seeing weird activity on your account. I need to verify your identity real quick. What's your username and the last 4 digits of your employee ID?"

How it works: They create a believable scenario. Once you start answering questions, you keep answering. Before you know it, they have everything.

How to protect yourself:

  • Real IT never asks for passwords
  • Real companies already have your employee ID
  • Say "Let me call you back" and use the official number
  • If they pressure you, that's a red flag
  • Create a company code word system for verification

4. Baiting

What it is: Leaving something tempting that's actually dangerous.

Physical baiting:

  • USB drive in the parking lot labeled "Executive Salaries 2025"
  • "Lost" phone or laptop

Digital baiting:

  • Free Netflix account! (it's malware)
  • Click here for free iPhone!
  • Pirated software downloads

Why it works: Curiosity kills the cat. And your computer.

True story: A security researcher dropped 297 USB drives around a university campus. 290 got plugged in. Some within minutes.

How to protect yourself:

  • Never plug in random USB drives (seriously, never)
  • If something's too good to be true, it is
  • Free movie downloads are never just free movies
  • Use official sources for everything

5. Quid Pro Quo

What it is: "Something for something" — they offer help in exchange for access.

Real example: "Hi! I'm calling about your IT support ticket #47392. We have a fix but I need to walk you through it on your computer."

You never submitted ticket #47392. Now they're remote controlling your machine.

How to protect yourself:

  • Don't accept unsolicited "help"
  • Verify through official support channels
  • No legitimate tech support calls you randomly
  • If you didn't ask for help, don't accept it

6. Tailgating (Piggybacking)

What it is: Following you into a secure building or area.

How it happens:

  • They carry boxes and ask you to hold the door
  • Dress like a delivery person
  • Walk in confidently while talking on the phone
  • "I forgot my badge, can you let me in?"

Why it works: We're taught to be polite and helpful. Holding the door feels natural.

I once walked into a "secure" facility wearing a polo shirt and carrying a clipboard. Nobody questioned me. I was there for a security test (with permission), but it was scary how easy it was.

How to protect yourself:

  • Wear your badge visibly
  • Don't hold doors for people without badges
  • "Sorry, you need to check in at the front desk"
  • Report suspicious people
  • It's okay to be "rude" about security

7. Vishing (Voice Phishing)

What it is: Phone call scams. Super effective.

Real example: "This is your bank's fraud department. We're seeing suspicious charges on your account. To verify it's you, I need your card number and the code on the back."

Your bank will NEVER ask for this.

Other common scripts:

  • "IRS calling about unpaid taxes"
  • "Microsoft tech support about your virus"
  • "Amazon about a large purchase"

How to protect yourself:

  • Hang up and call the official number yourself
  • Don't trust caller ID (it's easily faked)
  • Never give personal info over unsolicited calls
  • Legitimate companies don't threaten you
  • If they say "don't hang up," definitely hang up

8. Smishing (SMS Phishing)

What it is: Phishing by text message.

Example texts I've gotten:

`BANK ALERT: Unusual activity detected on your account. Click here to verify: [sketchy link]

Your package delivery failed. Reschedule here: [link]

You have (1) new voicemail. Listen here: [link]`

Why it's dangerous: People trust texts more than emails. We check texts immediately. Links are harder to examine on phones.

How to protect yourself:

  • Don't click links in texts from unknown numbers
  • Open your banking app directly instead
  • Check tracking on the delivery company's official site
  • Report spam texts to your carrier
  • Delete and move on

9. Fake Websites

What it is: Clone sites that look identical to real ones.

Real examples:

How it happens: You get an email or text with a link. Looks legit. Click it. Enter your username and password. Boom — they have your credentials.

How to protect yourself:

  • Look at the URL carefully
  • Check for HTTPS and the padlock icon
  • Type addresses manually instead of clicking links
  • Use a password manager (it won't autofill on fake sites)
  • Bookmark important sites

10. Social Media Impersonation

What it is: Fake profiles pretending to be someone you know.

How it works:

  1. They clone your friend's profile
  2. Send you a friend/connection request
  3. Start chatting
  4. Eventually ask for money, info, or send malicious links

Red flags:

  • "I got locked out of my account, can you help?"
  • "Check out this photo of you!" [suspicious link]
  • Duplicate friend requests
  • Messages that don't sound like them

How to protect yourself:

  • Verify friend requests (call or text the actual person)
  • Check how many mutual friends you have
  • Look at profile creation date
  • Report fake accounts immediately
  • Be skeptical of money requests

Quick Defense Checklist

For Emails: ✓ Check sender address carefully ✓ Hover over links (don't click) ✓ Look for grammar mistakes ✓ Question urgent requests ✓ Verify through another channel

For Phone Calls: ✓ Don't give info to unsolicited callers ✓ Hang up and call back on official numbers ✓ Never give passwords over phone ✓ Don't trust caller ID ✓ If pressured, definitely hang up

For Physical Security: ✓ Wear your badge ✓ Don't hold doors for strangers ✓ Report suspicious people ✓ Shred sensitive documents ✓ Lock your screen when away

For Social Media: ✓ Limit what you share about work ✓ Check privacy settings ✓ Verify connection requests ✓ Don't post travel plans publicly ✓ Assume everything is public

What If You Fall For It?

First: Don't panic. It happens to everyone. Seriously.

Immediate steps:

  1. Change your passwords (all of them if you reuse passwords)
  2. Turn on two-factor authentication
  3. Report it to your IT department
  4. Alert your bank if financial info was involved
  5. Scan your computer for malware
  6. Watch your accounts closely

Then: Learn from it. What worked on you? Why did you click? How can you spot it next time?

The worst thing you can do is hide it. Report it immediately. You're probably not the only target.

The Real Protection

Technology helps, but the best defense is your brain.

Before doing anything:

  • Pause for 5 seconds
  • Ask "Does this make sense?"
  • Verify through another method
  • Trust your gut

Red flag phrases:

  • "Act now or else"
  • "Urgent action required"
  • "Verify your account"
  • "You've won!"
  • "Don't tell anyone"
  • "Click here immediately"

If you see these, stop and think.

For Companies and Teams

If you're responsible for security at work:

Training that actually works:

  • Run regular phishing tests (start easy)
  • Share real examples
  • Make it okay to ask questions
  • Reward people who report attempts
  • No shame for falling for tests

Technical stuff:

  • Multi-factor authentication everywhere
  • Email filtering
  • Security awareness training
  • Clear reporting procedures
  • Regular security updates

Culture is everything:

  • Make security everyone's job
  • Praise people who question things
  • Lead by example (yes, executives too)
  • "Let me verify that" should be encouraged

Final Thoughts: How to Stay Ahead of Social Engineers

Social engineering thrives on trust, fear, curiosity, and urgency — not technology. The best defense is awareness and skepticism. Before clicking, sharing, or replying, always pause and verify.

Here's a quick recap:

  • Stay informed about evolving scams.
  • Use strong, unique passwords with MFA.
  • Limit your digital footprint.
  • Think before you click.