TL;DR: Social engineering is manipulating a person, not a computer, into handing over money, data or access. Attackers use urgency, authority, fear and trust, and the defense is to pause and verify through a separate channel. The UK NCSC and US CISA both teach this core habit. Free tool: Scan My Shadow's digital footprint checker at scanmyshadow.com/digital-footprint-checker.
👉 Check my digital footprint — free 30-second check →
Social engineering in cyber security means the human side of attacks. Instead of breaking software, the attacker persuades you. Most scams you read about, from fake bank calls to romance fraud, are social engineering.
Why social engineering works
- Urgency: "act now or lose access".
- Authority: a bank, police officer, boss or tech-support agent.
- Fear and greed: arrest threats, prizes, easy money.
- Trust and reciprocity: a friendly stranger who helped first.
Types of social engineering attacks
- Phishing, smishing and vishing: fake email, text or call; see how to spot and report phishing.
- Pretexting: an invented scenario, such as a fake IT support caller, to extract information.
- Baiting: a tempting download, prize or USB drive.
- Quid pro quo: "help" in exchange for access, such as remote-control tools.
- Impersonation and tailgating: posing as staff to get physical or account access.
Social engineering examples
- Fake bank fraud departments asking you to move money to a "safe account".
- Romance scammers building trust before asking for money: romance scam red flags.
- Impersonated relatives on chat apps: WhatsApp scams.
- Fake officials threatening arrest: digital arrest scams.
- Business email fraud: CEO fraud emails.
How to defend yourself
- Slow down: pressure is the signal.
- Verify through a channel you already trust; call back on a number from the official site.
- Never share codes, PINs or remote access.
- Limit what you post; attackers use it to build the story. See what your footprint reveals.
- Report it: the FTC, Action Fraud, CAFC, Scamwatch, or in India the cybercrime portal and 1930.
FAQs
What is social engineering?
The manipulation of people into giving up money, information or access, rather than breaking technology. It relies on psychological pressure such as urgency, authority and fear.
What are common social engineering attacks?
Phishing, smishing, vishing, pretexting, baiting, quid pro quo offers, impersonation and tailgating into physical spaces.
What is pretexting?
Pretexting is inventing a believable scenario, such as a support agent needing to verify your identity, to get you to share information.
What is an example of social engineering?
A caller claiming to be your bank's fraud team who asks you to move money to a safe account, or a message from a relative's new number asking for urgent cash.
How do I defend against social engineering?
Pause, verify through a separate trusted channel, never share codes or remote access, and report attempts.
Is social hacking the same as social engineering?
Social hacking usually means using social engineering to take over or exploit social media accounts.
What is hacking social engineering?
Hacking social engineering means using manipulation rather than technical exploits to get access, such as tricking someone into sharing a password or approving a login.
What are social engineering threats to individuals?
Fake bank calls, romance scams, impersonated relatives, phishing links and tech-support scams that push you to send money or share codes.
Before scammers use your details, see them first: check what is already public about you.
Curious what's already out there? Scan My Shadow checks a phone number and email across 1,500+ sources and sends a clear report — no guesswork, just facts. Start your scan.