Social engineering defined

What Is Social Engineering?

Social engineering is the art of manipulating people so they give up confidential information. Rather than breaking into systems using technical exploits, a social engineer targets the human element: exploiting trust, authority, urgency, or fear to trick individuals into revealing passwords, granting access, or performing actions they would not normally take.

Social engineering is often more effective than technical attacks because no amount of software security can fully protect against a well-trained employee who is genuinely deceived. It underpins many of the most damaging real-world cyber attacks - attackers may use social engineering to gain initial access and then use that foothold to launch further technical attacks.

Attacker crafts scenario Targets victim (email/call/in person) Builds false trust or urgency Victim divulges information 🔓

Social engineering follows a consistent pattern: create a believable scenario, target a victim, build trust or urgency, and wait for the victim to hand over what the attacker needs.

Three Forms of Social Engineering

Blagging (Pretexting)

Blagging is the act of creating and using an invented scenario to engage a targeted victim in a manner that increases the chance the victim will divulge information or perform actions that would be unlikely in ordinary circumstances. The attacker constructs a false but plausible identity or situation - the "pretext" - to gain the victim's trust.

Unlike phishing (which is usually sent to many targets at once), blagging is typically more targeted and personal. The attacker may research the victim beforehand - using social media, company websites, or previous conversations - to make the invented scenario more convincing.

Examples of blagging:
  • Calling a company's helpdesk pretending to be a senior employee who has forgotten their password, using details about the company to sound plausible.
  • Emailing an employee pretending to be from IT support, claiming there is an urgent security issue and asking them to confirm their login credentials.
  • Visiting a building pretending to be a maintenance contractor, using a confident manner and a plausible story to gain physical access.

Why it works: people generally want to be helpful and are reluctant to challenge someone who appears authoritative or who presents a convincing reason for their request. Blagging exploits social norms around trust and courtesy.

Phishing

Phishing is a technique of fraudulently obtaining private information, often using email or SMS. The attacker sends a message that appears to come from a legitimate and trusted source - a bank, a government department, a well-known company, or even a colleague - and directs the recipient to provide sensitive information or click a malicious link.

Common phishing characteristics:
  • A sense of urgency: "Your account will be suspended unless you act within 24 hours."
  • A link to a fake website that looks identical to the genuine one, where credentials are harvested.
  • A request to confirm personal details such as passwords, account numbers, or date of birth.
  • A sender address that looks legitimate at a glance but contains a subtle difference (e.g. [email protected] rather than [email protected]).

Spear phishing is a targeted version directed at a specific individual or organisation, using personal details to make the message more convincing. Smishing uses SMS text messages rather than email. In all cases, the attacker is counting on the recipient not looking closely before acting.

Shouldering (Shoulder Surfing)

Shouldering is observing a person's private information over their shoulder - for example, watching someone enter a PIN at a cashpoint machine, type a password at a computer, or fill in a form on their phone. Unlike phishing and blagging, shouldering does not require any communication with the victim - it is a passive, observational attack.

Examples of shouldering:
  • Standing close behind someone at an ATM and watching them enter their PIN.
  • Sitting next to someone on public transport and watching them type their email password on a laptop.
  • Observing a colleague entering a door code or security passcode in a workplace.

Why it is effective: most people do not notice or think to check whether they are being observed when entering information they enter routinely. The victim receives no suspicious message and has no reason to be on guard.

Protecting Against Social Engineering

Since social engineering exploits human behaviour rather than technical vulnerabilities, the most important defences are also human-centred:

  • Staff training and awareness: employees who know how to recognise phishing emails, suspicious phone calls, and blagging attempts are far less likely to be deceived. Regular training and simulated attacks help organisations assess and improve awareness.
  • Verification procedures: establish a clear process for verifying the identity of anyone requesting access or sensitive information - especially over the phone or by email. Legitimate requests can wait for verification; pressure to act immediately is itself a warning sign.
  • Clear policies: organisations should have policies specifying that passwords are never shared over email or phone, that links in unexpected emails should not be clicked, and that credential resets must follow a specific process.
  • Physical measures: shielding PIN entry at cashpoints, using privacy screens on laptops in public places, and being aware of surroundings when entering sensitive information all reduce the risk of shouldering.
  • Two-factor authentication (2FA): even if an attacker obtains a password through social engineering, 2FA means they still cannot access the account without a second factor (e.g. a code sent to a phone).

 Key Takeaways

  • Social engineering is manipulating people to give up confidential information, exploiting human psychology rather than technical weaknesses.
  • Blagging uses an invented scenario to trick a victim into divulging information or performing an action they would not normally take.
  • Phishing uses fraudulent emails or SMS messages to obtain private information, often via fake websites or urgent requests.
  • Shouldering is observing someone's private information over their shoulder, requiring no communication with the victim.
  • Protection combines training, verification procedures, clear policies, physical awareness, and 2FA.