Social engineering is manipulation—attackers use psychology, urgency, and authority to trick people into revealing information, transferring money, or granting access. This guide helps you recognize common tactics and respond appropriately.
Core Rule: When in Doubt, Verify Independently
- If someone requests urgent action, sensitive information, or access, STOP and verify they are who they claim to be
- Use a known phone number or contact method from your organization, not information provided by the caller
- Never provide passwords, credit card numbers, or access codes via email, phone, or messaging apps
Common Social Engineering Tactics
1. Pretexting (Creating a False Scenario)
Common Pretext Scenarios
"Hi, I'm from IT support. We detected a security issue on your computer. I need you to click this link and enter your password so I can fix it."
Red Flags:
- Caller claims to be from IT but you don't recognize them
- They create urgency ("act now" / "your account will be locked")
- They ask for passwords or credentials
- They send unsolicited messages or links (legitimate IT wouldn't)
- The sender's email or phone number doesn't match your IT department
Authority Impersonation
"This is the CEO. We need you to wire $50,000 to this vendor immediately. Keep this confidential and don't ask questions."
Red Flags:
- Attacker impersonates a senior executive or authority figure (CEO, FBI, IRS, bank)
- Demands secrecy ("don't tell anyone," "keep this quiet")
- Creates false urgency or consequences ("or you're fired," "account closure")
- The tone or writing style doesn't match what you'd expect from that person
- Requests unusual payment method or unusual recipient
2. Phishing (Fake Communications)
Phishing Email Tricks
Email appears to be from your bank: "Your account has unusual activity. Verify your account here: bankofamerica-login.phish.com"
Red Flags:
- Email appears to be from a trusted company but sender email is slightly off
- Generic greeting ("Dear Customer" instead of your name)
- Requests to click a link to "verify" or "confirm" information
- Linked URL doesn't match the company domain (hover to check)
- Attachment with unexpected file type (.exe, .zip, etc.)
3. Pretexting for Access (Vishing - Voice Phishing)
Phone Call Attack
"Hi, this is John from Tech Support. Your account has been flagged for suspicious activity. Can you verify your employee ID and password so I can unlock it?"
Red Flags:
- Unsolicited call asking for sensitive information
- Caller claims to be from your company's IT but you don't recognize them
- They claim there's a problem and need to "verify" your details
- Sound quality is poor or background noise is unusual (could be spoofed)
- They pressure you to act quickly
4. Quid Pro Quo (Offering Something in Return)
Reward or Favor Tactics
"I found a USB drive in your parking lot with 'Payroll' written on it. I'll return it if you confirm your employee number so I can deliver it safely."
Red Flags:
- Someone offers help or a reward in exchange for information
- They ask for "just a little information" to complete a transaction
- The offer seems too convenient or good to be true
- They create obligation ("I'm helping you, so you should help me")
5. Baiting (Leaving Physical Items)
Physical Baiting Tactics
A USB drive labeled "Executive Salaries 2024" is left in the lobby or parking lot. An employee picks it up and plugs it into their computer.
Red Flags:
- Finding media (USB, CD) with a curiosity-inducing label
- Plugging unknown devices into company computers
- Device appears to have been left in an unusual place
6. Tailgating / Shoulder Surfing (Physical Access)
Physical Access Tricks
An attacker follows an employee through a locked door by pretending to be a vendor or contractor. Or they position themselves to watch someone enter a PIN or password.
Red Flags:
- Someone you don't recognize trying to enter through a secure door
- Person standing too close while you're entering a PIN or password
- Someone asking to "follow you in" after you unlock a door
Verification Steps: The Right Way to Respond
Before You Share Any Information or Click Any Link
Rule 1: Verify the Sender Independently
- If someone calls claiming to be from your bank, hang up and call your bank's official number (from your statement or website, not the phone number they provided)
- If an email appears to be from your company, contact that department directly using a known phone number or email
- Never use contact information provided in the suspicious message—find your own
Rule 2: Ask for More Details (to Confirm Legitimacy)
- "Can you provide a case/ticket number I can reference?" (Real companies track requests)
- "What is the exact issue you're calling about?" (Social engineers may not have details)
- "Let me have a colleague verify this" (Legitimate requests don't require immediate secrecy)
- "Can I call you back at the main company number?" (Real employees have a callback number)
Rule 3: Watch for Pressure and Secrecy
- Legitimate requests don't demand urgency or secrecy
- Real companies don't say "don't tell anyone" or "this is confidential" when asking routine questions
- If someone pressures you, it's a red flag—take time to verify
Rule 4: Hang Up and Reinitiate Contact
- If you receive a suspicious call, hang up without providing info
- Look up the company's official phone number and call them back
- Ask if anyone just called you—legitimate organizations will know
Reporting Social Engineering Attempts
Who to Notify
Internal Reporting
- Report to your IT security team or help desk immediately
- Forward suspicious emails (don't click anything first)
- Report phone calls to your manager or security officer
- Note: You won't be punished for reporting a mistake—that's the point
Information to Include
Details to Provide When Reporting
- For email: Who it claimed to be from, the email address, subject line, and any URLs or attachments
- For calls: What they claimed, phone number (if displayed), time of call, and what they asked for
- For physical: When and where it occurred, description of the person, and what they accessed or attempted to access
- Whether anyone clicked a link, opened an attachment, or disclosed information
Real World Examples & Responses
Scenario 1: Fake IT Support Call
What They Say: "Hi, this is Jake from Microsoft Support. We detected malware on your computer. I need to remote into it to fix it."
What You Should Do:
What You Should Do:
- Hang up immediately
- Do NOT let them remote in
- Call your actual IT department (look up the number yourself)
- Report to security
Scenario 2: Business Email Compromise (CEO Fraud)
What They Say: Email from "CEO": "We're acquiring a company. Wire $100k to this account immediately. Don't tell anyone."
What You Should Do:
What You Should Do:
- DO NOT wire money immediately
- Call the CEO's office directly (look up the main number)
- Ask about the acquisition—legitimate execs expect verification
- Confirm the wire request through normal channels
- Report the email to security
Scenario 3: Suspicious USB Device
What You Find: A USB drive labeled "Q4 Bonus Spreadsheet" in the parking lot
What You Should Do:
What You Should Do:
- DO NOT plug it into your work computer
- Turn it in to IT or security
- Let them analyze it safely
- Never plug in unknown media
Organizational Best Practices
Social engineering isn't just an individual issue—it's an organizational problem. Help your workplace implement:
- Security awareness training: Regular training on spotting social engineering
- Phishing simulations: Test employees with fake phishing emails to raise awareness
- Verification procedures: Always verify sensitive requests (wire transfers, access changes) through multiple channels
- Physical security: Badge readers, visitor logs, and escort policies for unfamiliar people
- Incident response: A clear process for reporting suspicious activity
- Culture of verification: Make it normal to ask "let me confirm that" before acting on requests
Quick Mental Checklist
When Someone Requests Information, Action, or Access—Ask Yourself:
- Am I certain this person is who they claim to be?
- Is this request coming through the normal channel?
- Do they seem to be in a hurry or creating pressure?
- Are they asking for something unusual (passwords, wire transfer, access)?
- Are they asking me to keep it secret or not tell others?
If any of these answers is "yes," VERIFY INDEPENDENTLY before acting.