Social engineering
Social engineering is hacking the person instead of the computer. The attacker talks, emails, or calls their way past your defences by making you want to help, trust, or obey. Phishing is one form; there are many others.
Common moves
- Pretexting — inventing a believable story ("I'm from the IT vendor, we're doing maintenance tonight").
- Impersonation — pretending to be a boss, a colleague, or a supplier.
- Baiting — offering something tempting, like a free gift card or a found USB drive.
- Tailgating — following someone through a secure door without their own badge.
- Urgency and authority — "The CEO needs this right now" leaves no room to check.
The tell is the pressure to skip a step
Almost every social-engineering attack asks you to bypass a normal process: pay without the usual approval, share a password "just this once", let someone in without a badge, or act before you verify. When a request pushes you to break the rules, that pressure is the warning sign.
How to resist
- Verify out of band. Confirm the request through a separate, known channel, not the one the request came in on.
- It is okay to say "let me check". A real colleague will understand. An attacker will push harder, which only confirms your suspicion.
- Follow the process even under pressure. Processes exist precisely for the moments when someone is trying to rush you.
You are not being rude by verifying. You are doing your job.