# What is social engineering?

URL: https://iblockspam.com/blog/what-is-social-engineering
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Email security basics
Author: iBlockSpam Team

> Social engineering tricks people, not computers, into giving up passwords, money or access. Learn the main types, real email examples and defenses that work.

## Short answer

Social engineering is manipulating people into revealing information, granting access or sending money, by posing as someone they trust. NIST defines it as an attempt to trick someone into revealing information that can be used to attack systems. Phishing, pretexting, business email compromise, help desk impersonation and MFA fatigue are all forms of it.

Most cyberattacks still need a person to do something: type a password, approve a sign-in, open a file, or send a payment. Social engineering is how attackers get that person to do it. This guide explains what it is, the forms it takes in email and beyond, what it looks like in real messages, and which defenses actually work.

## What is social engineering in cybersecurity?

Social engineering is manipulating people, rather than breaking technology, to get information, access or money. [NIST's glossary](https://csrc.nist.gov/glossary/term/social_engineering) defines it as "an attempt to trick someone into revealing information (e.g., a password) that can be used to attack systems or networks." CISA's description is similar: an attacker "uses human interaction (social skills) to obtain or compromise information about an organization" ([CISA](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks)).

The attacker's tools are trust and pressure. They pose as someone you're expected to help, such as your manager, a supplier, IT support, your bank or a government agency. Then they give you a reason to act before you think.

## How does a social engineering attack work?

Most attacks follow the same four steps, whatever the channel:

1. **Research.** The attacker learns names, roles, suppliers and routines from your website, LinkedIn, press releases or a mailbox they already control.
2. **Pretext.** They build a believable story: an overdue invoice, a locked account, a CEO stuck in a meeting.
3. **Pressure.** They add urgency, authority or fear so you skip your normal checks.
4. **Ask.** They request one action: click, sign in, read out a code, buy gift cards, change bank details.

The FTC's [four signs of a scam](https://consumer.ftc.gov/articles/how-avoid-scam) map onto these steps: scammers "PRETEND to be from an organization you know," say "there's a PROBLEM or a PRIZE," "PRESSURE you to act immediately," and tell you "to PAY in a specific way."

## What are the main types of social engineering?

Social engineering isn't one attack. It's a family of techniques that share the same psychology. This table shows the ones businesses see most.

| Type | What it is | Typical channel | Main defense |
|---|---|---|---|
| Phishing | Fraudulent messages that pose as a trusted brand or person to steal logins or deliver malware | Email | Filtering, link checks, reporting button |
| Spear phishing | Phishing tailored to one person or team using researched details | Email | Impersonation protection, verification habits |
| Pretexting | An invented story that justifies an unusual request | Email, phone | Verify through a channel you already know |
| Business email compromise (BEC) | Posing as an executive, supplier or lawyer to redirect a payment | Email | Call-back rule, dual approval for payments |
| Vishing and callback phishing | Voice calls, or emails that push you to call a fake support number | Phone, email | Never call numbers from unexpected messages |
| Smishing | Phishing by text message | SMS | Don't follow links in unexpected texts |
| Help desk impersonation | Attacker calls IT posing as an employee to reset a password or MFA | Phone | Strong identity checks at the help desk |
| MFA fatigue (push bombing) | Repeated sign-in approval prompts until the user accepts | Authenticator app | Number matching, phishing-resistant MFA |
| Baiting and quid pro quo | A free download, prize or "help" offered in exchange for access | Email, web, USB | Don't install or plug in unexpected items |

For the email types in more depth, see [what is phishing](https://iblockspam.com/blog/what-is-phishing), [spear phishing vs phishing vs whaling](https://iblockspam.com/blog/spear-phishing-vs-phishing-vs-whaling) and [phishing vs smishing vs vishing](https://iblockspam.com/blog/phishing-vs-smishing-vs-vishing).

## What does social engineering look like in an email?

Most business social engineering arrives by email, because it's cheap and lets the attacker impersonate anyone. Here are three examples. They're illustrations written for this guide, not real messages.

### A pretexting email from a "supplier"

> **Example (fraudulent)**
> From: Dana Ortiz <accounts@examp1e-supplies.com>
> Subject: Updated remittance details for November
> Hi, we've moved banks after an audit. Please use the attached details for this month's invoice and all future payments. Our phones are being upgraded this week, so email is the best way to reach me.

The pretext (a bank change after an audit) explains the request, and the "phones are down" line blocks the one check that would expose it. Note the lookalike domain with a digit 1 in place of the letter l. This is the core of [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).

### An authority and urgency email from the "CEO"

> **Example (fraudulent)**
> From: "Alex Chen, CEO" <alex.chen.office@gmail.com>
> Subject: Quick favor, confidential
> Are you at your desk? I need you to handle something for me before my 3pm board call. Don't mention it to anyone yet.

The display name is real; the address isn't. This is [display name spoofing](https://iblockspam.com/blog/display-name-spoofing), and the next message usually asks for [gift cards](https://iblockspam.com/blog/gift-card-scam-emails) or an urgent wire.

### A "call us" email

> **Example (fraudulent)**
> Subject: Your annual protection plan renewed: $499.99
> If you did not authorize this charge, call our billing team within 24 hours at the number below to cancel.

There's no link or attachment for a filter to catch. The attack happens on the phone, where the "agent" asks for remote access or bank details. See [callback phishing](https://iblockspam.com/blog/callback-phishing-phone-scam-emails).

## How do attackers use social engineering against IT and MFA?

Social engineering doesn't only target finance staff. Some of the most damaging intrusions start with a phone call to the help desk. The joint [Scattered Spider advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a) from the FBI, CISA and international partners describes attackers who:

- "Posed as company IT and/or helpdesk staff using phone calls or SMS messages" to get employees' credentials.
- "Posed as employees to convince IT and/or helpdesk staff" to reset passwords or move MFA to a device the attackers control.
- "Sent repeated MFA notification prompts leading to employees pressing the 'Accept' button (also known as MFA fatigue)."
- Convinced mobile carriers to transfer control of a targeted user's phone number to a SIM card they held (SIM swapping).

Among its mitigations, the advisory says to "require phishing-resistant multifactor authentication (MFA) for all services to the extent possible," such as FIDO/WebAuthn or PKI-based MFA, which it says are "not susceptible to push bombing or SIM swap attacks." Our guide to [passkeys and phishing-resistant MFA](https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email) explains how to roll them out. Phishing kits that relay your login in real time are covered in [adversary-in-the-middle phishing](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass).

## How much does social engineering cost?

The FBI's [2025 IC3 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) ranks the costliest cyber-enabled fraud types by reported loss. Several of them are social engineering by definition:

| Crime type (IC3, 2025) | Reported losses |
|---|---|
| Business email compromise | $3,046,598,558 |
| Tech support scams | $2,134,675,818 |
| Confidence/romance scams | $929,287,469 |
| Government impersonation | $797,943,193 |

These are losses reported to the IC3 only, so the real totals are higher. For more sourced figures, see [phishing statistics](https://iblockspam.com/blog/phishing-statistics).

## How do you protect a business from social engineering?

Use two layers: technical controls that cut down how many attacks reach people, and simple rules that hold even when an attack gets through.

### Technical controls

1. **Filter inbound email** for phishing, spoofing and malware before it reaches the inbox. That's what an MX-level service such as iBlockSpam does for [small businesses](https://iblockspam.com/solutions/small-business).
2. **Enforce DMARC** on your domain so nobody can send email as your exact address. Check yours with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).
3. **Flag external and first-contact senders** so a fake "CEO" from an outside address stands out.
4. **Watch for lookalike domains** of your own name with the [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator).
5. **Use phishing-resistant MFA** and number matching, and block legacy sign-in methods.
6. **Make reporting one click**, and act on reports quickly. See [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email).

### Verification rules people can follow

1. **Call back on a known number** before acting on any request to pay, change bank details, buy gift cards or share credentials. Never use the number in the message.
2. **Two people approve** new payees and large transfers.
3. **The help desk verifies identity** before resetting a password or MFA, for example with a manager call-back or an in-person check.
4. **Never read out a one-time code** to anyone who calls you. Legitimate IT doesn't need it.
5. **Make it safe to say no.** Tell staff in writing that no executive will be upset by a verification call.

Short, regular training helps people spot the patterns; see [security awareness training for small business](https://iblockspam.com/blog/email-security-awareness-training-small-business). Deepfake voices make the call-back rule even more important, as [AI voice cloning and deepfake BEC](https://iblockspam.com/blog/ai-voice-cloning-deepfake-bec) explains.

## What should you do if you've been socially engineered?

Act fast and don't be embarrassed; delay helps the attacker more than anything you did.

- **If you typed a password**, change it from a device you trust and sign out all sessions. Follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).
- **If you approved an MFA prompt you didn't start**, tell IT at once; the attacker may already be signed in.
- **If you sent money**, call your bank immediately, then file at [ic3.gov](https://www.ic3.gov). Our [BEC wire transfer recovery guide](https://iblockspam.com/blog/business-email-compromise-wire-transfer-recovery) covers the exact steps.
- **If you gave remote access**, disconnect the device from the network and have it checked.

## Next steps

- Open a suspicious message's headers in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see who really sent it.
- Write a one-page verification rule for payments and help desk resets, and share it with every employee.
- Check that your domain enforces DMARC and that you know which lookalike domains exist.
- If you're a small business without a security team, see how iBlockSpam [protects small businesses](https://iblockspam.com/solutions/small-business) with phishing and spoofing protection.

## Frequently asked questions

### What is the difference between social engineering and phishing?

Social engineering is the broad technique of manipulating people. Phishing is one form of it that uses fraudulent emails or websites. CISA describes phishing as a form of social engineering, alongside vishing (voice calls) and smishing (text messages). Pretexting, help desk impersonation and in-person tricks are social engineering too, even when no email is involved.

### What are the most common social engineering techniques?

The techniques you'll meet most often are phishing emails, pretexting (an invented story that justifies a request), business email compromise, callback scams that move you to a phone call, help desk impersonation, and MFA fatigue, where an attacker floods you with approval prompts until you accept one. Most combine impersonation with urgency.

### Can technology stop social engineering by itself?

No. Filters, DMARC and phishing-resistant MFA remove many attacks and make others harder, but a convincing phone call or a message from a hijacked real account can still reach a person. You need both: technical controls to cut volume, and simple verification rules that people follow even when a request seems to come from the boss.

### What is pretexting in cybersecurity?

Pretexting is building a believable story, the pretext, to justify an unusual request. Examples include a caller posing as IT who needs your one-time code, or an email from a new accountant at a supplier asking you to update bank details. The story is what makes the request feel normal, so verifying it independently is the defense.

### Why do smart people fall for social engineering?

Because it targets normal habits, not intelligence. Attackers pose as people you're expected to help, create time pressure, and pick moments when you're busy. The FTC's four signs of a scam are that the scammer pretends to be from an organization you know, claims a problem or prize, pressures you to act now, and tells you how to pay.

## Sources

- [NIST CSRC Glossary: social engineering](https://csrc.nist.gov/glossary/term/social_engineering)
- [CISA: Avoiding Social Engineering and Phishing Attacks](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks)
- [CISA, FBI and partners: Scattered Spider advisory AA23-320A (revised July 29, 2025)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [FTC: How To Avoid a Scam](https://consumer.ftc.gov/articles/how-avoid-scam)
- [FBI IC3: 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3: Business Email Compromise](https://www.ic3.gov/CrimeInfo/BEC)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator): See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/what-is-social-engineering (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt