What is social engineering? Attack types, real examples and how to defend your company

By Kike Gandia · Co-Founder & CEO, OSCP

Social engineering is the manipulation of people into doing something that benefits an attacker: handing over a password, approving a login, changing a bank account, opening an attachment or letting them into the office. Instead of exploiting a software flaw, it exploits human tendencies such as deference to authority, urgency or the wish to help. It arrives by email, phone, text message, QR code or in person, and it sits behind a large share of breaches: Verizon's 2026 DBIR finds the human element in 62% of them. This guide explains how it works, the main techniques, real cases and how to measure and strengthen your company's resilience.

What social engineering is and why it works so well against companies

Social engineering is the set of techniques an attacker uses to get a legitimate person to do the work for them. There is no need to break encryption or find a vulnerability: it is enough for someone with access to hand over a credential, approve an MFA prompt, run a file, change a supplier's bank details or hold a door open.

That is why it pays off. An email, a call or a visit costs little and leverages permissions the victim already has, so the attacker walks in through the front door and many technical controls see nothing unusual. Verizon's 2026 DBIR finds the human element in 62% of the breaches it analyses, up from 60% the year before, and ranks social engineering as the third most common breach pattern, at 16% of the total. It also notes that attackers increasingly use voice and other mobile channels to catch people off guard in the middle of the workday.

Attacks mostly pursue two things:

Access: credentials, sessions, MFA codes or the installation of a remote access tool, as the first step of an intrusion that can end in ransomware or data theft.
Direct fraud: getting someone to transfer money or change payment details without compromising any system at all, as in CEO fraud.

The psychological principles it exploits

Social engineering works because it relies on mental shortcuts we all use every day and that nearly always serve us well. Psychologist Robert Cialdini described them in his book Influence (1984) as principles of persuasion —reciprocity, commitment and consistency, social proof, authority, liking and scarcity, later joined by a seventh, unity— and attackers combine them with emotions such as fear and curiosity:

Lever	How the attacker uses it	Illustrative example
Authority	Poses as someone with the power to give orders	“This is the CFO, I need this before the meeting”
Urgency and scarcity	Cuts the time available to think or verify	“Your account will be locked in 30 minutes unless you confirm”
Reciprocity	Does a favour, then asks for something back	A fake technician who “fixes” a problem and asks for the password to finish
Social proof	Suggests everyone else has already done it	“Your whole department has already completed the verification”
Liking and unity	Builds rapport or a sense of belonging	A supposed colleague from another office who mentions real projects and names
Commitment and consistency	Gets a small first yes, then escalates the request	First confirming a harmless detail, then reading out the code that arrives by SMS
Fear	Threatens a negative consequence	A supposed fine, inspection or legal claim
Curiosity	Triggers interest in some content	A USB stick labelled “Payroll 2026” or a file called “layoffs.xlsx”

A good pretext combines several levers at once: authority plus urgency is the classic CEO fraud formula; help plus reciprocity is the fake tech support one. Being able to name them helps people recognise them, but it does not make anyone immune: in a hurry and under pressure, anyone can fall for it.

The lifecycle of a social engineering attack

Well-run attacks are not improvised. INCIBE, Spain's national cybersecurity institute, describes four phases —information gathering, building a relationship of trust, abusing that trust and executing the attack— which in practice look like this:

Reconnaissance (OSINT): the attacker studies the company using open sources. Org chart and job titles on LinkedIn, email address format, suppliers and tools in use, job ads that reveal technologies, photos of badges or the office on social media. The better this phase, the more credible everything that follows.
Pretext: they build the story and choose the channel and the victim. A support technician calling about a VPN problem, a supplier announcing a change of bank account, a courier with a parcel for reception. A good pretext has answers ready for the questions the victim might ask.
Exploitation: they ask for the specific action —entering credentials, approving access, paying, plugging in a device, opening a door— at the moment the victim has the least room to hesitate.
Exit: they close the interaction without raising suspicion so nobody reports anything, and use the access they gained. Often the victim never realises they were part of an attack, and the attacker can reuse the same contact later.

This sequence explains why a company's public exposure matters: much of the attacker's work is done before the first message is sent, using information the organisation itself has published.

Types of social engineering attacks: technique, channel and goal

Techniques are mainly classified by the channel they use. This is a reference table of the most common ones used against companies:

Technique	Channel	Typical goal
Phishing	Bulk email	Credentials or malware execution at scale
Spear phishing	Email targeted at a person or team	Access to a specific profile: finance, IT, leadership
Vishing	Voice call, sometimes with an AI-cloned voice	Credentials, MFA codes or installing remote access
Smishing	SMS or instant messaging	Credentials or installing malicious apps
Quishing	QR code in an email, a PDF or a poster	Credentials, on a phone and outside corporate filters
Pretexting	Any, with an elaborate story	Information, data changes or access
CEO fraud / BEC	Email, call or messaging impersonating an executive or supplier	Wire transfers and bank detail changes
MFA fatigue (push bombing)	Repeated push notifications	Getting the user to approve someone else's login
Baiting / USB drop	Abandoned physical device	Code execution on an internal machine
Tailgating or piggybacking	Physical access behind an authorised person	Entering restricted areas
In-person impersonation	On site: technician, courier, auditor, candidate	Physical access, devices or information
Watering hole	A legitimate website the target group visits	Infecting visitors from a sector or company

Phishing and its variants have their own guide in our resource on types of corporate phishing, and CEO fraud, vishing with voice deepfakes and quishing each have dedicated articles. What matters here is the big picture: the attacker picks the channel where the victim is least protected and least alert. An excellent email filter does not eliminate the attack; it pushes it to the phone, to SMS or to reception.

Real examples of social engineering attacks

Two documented cases show that sophisticated exploits are not needed to compromise large organisations:

Twitter (July 2020): according to the report published in October 2020 by the New York State Department of Financial Services (NYDFS), the attackers called several employees posing as the IT help desk, using a VPN problem as the pretext, something common after the move to remote work. They used employees' personal information to sound credible and directed them to a copy of the VPN login page hosted on a lookalike domain. As the victim typed their credentials, the attackers entered them on the real site, and some employees approved the MFA prompt they received. From there they reached internal support tools: 130 accounts were affected, including those of very well-known figures, which were used for a scam that brought in around $118,000 in bitcoin. The same report notes that some employees did report the calls; it only took one person believing the attackers.
MGM Resorts (September 2023): the company had to shut down systems and suffered disruption at some of its properties. In its SEC filing it did not say how the attackers got in, and it estimated a negative impact of around $100 million on its Adjusted Property EBITDAR for the quarter. The entry vector that became public comes from the attackers' own claim, reported by the press: finding an employee on LinkedIn and calling the help desk while impersonating them.

The pattern repeats. In their joint advisory on the Scattered Spider group, CISA and the FBI describe calls to help desks to get them to reset passwords or transfer MFA to an attacker-controlled device, alongside SIM swapping and MFA push bombing. The target is no longer just the employee: the help desk itself has become an entry point.

Why technology alone is not enough

Technical controls greatly reduce the volume of attacks that reach people, and you need them. But social engineering is designed precisely to go where those controls do not reach:

Unfiltered channels: a call to a mobile phone, an SMS, a WhatsApp message or a visit to reception never pass through the email gateway.
Legitimate senders: if the attacker has compromised a supplier's real account, their emails pass SPF, DKIM and DMARC because they are genuine.
Authorised actions: when an employee approves a payment or enters their password, the system sees a legitimate user doing something they are allowed to do.
MFA that can be bypassed: the Twitter case shows that a password and its MFA prompt can be captured in real time through a fake site, and the CISA and FBI advisory describes push bombing and SIM swapping. On top of that, no MFA helps if the help desk resets it at the attacker's request.
The physical world: a turnstile or a badge reader does not stop someone from walking in behind a friendly colleague who holds the door.

The reverse is also true: training alone is not enough either. One awareness session a year makes nobody infallible. The defence that works combines processes that do not depend on one person's judgement under pressure, technology that limits what a mistake can cause and a culture in which reporting is easy.

How to measure your company's resilience to social engineering

The reliable way to know how your organisation would respond is to test it with simulated attacks that are controlled and authorised by management. Each type of simulation measures something different:

Simulation	What it measures	Useful indicators
Bulk and targeted phishing	Detection in the inbox and reaction after the click	Click rate, credential submission rate, report rate and time to first report
Vishing, including the help desk	Whether phone verification procedures are followed	Calls in which information is given or the requested action is taken, and calls reported
On-site pretexting	Physical access control and willingness to question a stranger	Areas reached, time inside and how often someone asks for ID or raises the alarm
USB drop	Behaviour with found devices	Devices plugged in, detected with a harmless beacon and no malicious payload, and devices handed to IT

Two ideas for reading the results. First: the report rate and how fast reports arrive say more than the click rate, because a real attack is contained when someone raises the alarm in time, even if others have fallen for it. Second: measuring email alone gives an incomplete picture. Verizon's 2026 DBIR states that, in the simulations it analyses, the median click rate for those using mobile channels, such as voice and text messages, is 40% higher than for email ones.

At QuantumSec we run these simulations —phishing, vishing, on-site pretexting and USB drop, separately or combined— with prior OSINT reconnaissance, a scope agreed with management and a per-department report aimed at fixing processes, not singling out people. Before launching a campaign in Spain, check how it fits with the GDPR and Spanish employment law and decide which indicators you will track; we cover both topics in dedicated guides.

Layered defences against social engineering

No single measure is enough. The goal is that one mistake alone is not enough for the attack to succeed.

Processes that do not rely on good faith

Out-of-band verification: any change of bank details, urgent payment or unusual request is confirmed through a different channel from the one it arrived on, by calling a number the company already had on file, never the one in the message.
Dual approval for payments above a threshold and for adding or changing suppliers.
A help desk with robust verification: resetting a password or an MFA method requires confirming identity through an independent channel or approval from the person's line manager. Details such as an ID number or date of birth are useless, because an attacker may have them.
Visitors and access: visible badges, visitors always escorted and explicit permission for anyone to question a stranger without seeming rude.

Technology that limits the damage

Phishing-resistant MFA: CISA recommends requiring it on every service possible, through FIDO/WebAuthn —security keys or passkeys— or PKI certificates, because it is not susceptible to push bombing or SIM swapping. Start with administrators, leadership and finance.
Email authentication with SPF, DKIM and DMARC, plus external sender warnings, to curb spoofing of your own domain.
Least privilege and device control: an unknown USB stick should not be able to run anything, and a compromised account should not grant access to everything.

People and culture

One-click reporting: a report button in the email client and a clear channel for suspicious calls or visits, with a fast response from IT.
A no-blame culture: someone who falls for it and reports it within five minutes is helping; someone who stays silent for fear of reprisals turns a small incident into a serious one.
Continuous, contextual training: short, frequent, based on the attacks the company actually receives and with examples from every channel, not just email.

Where to start if you have never measured it

For a small or mid-sized company starting from scratch, this order usually gives the best return on effort:

Review the processes that move money: how is a change of bank details or an urgent transfer approved? If the answer is “it depends on who asks”, that is your first risk.
Review the help desk: what does someone who calls claiming to be an employee need in order to get a password or MFA reset?
Protect critical accounts with phishing-resistant MFA: administrators, leadership and finance.
Make reporting easy and make it clear that reporting never has negative consequences, even when the person reporting fell for it.
Measure with a simulation that covers more than email, to get a real baseline.
Train on what failed and repeat the measurement to check whether it has improved.

Social engineering is not eliminated; it is managed. The realistic goal is not that nobody ever clicks, but that an attack has to fool several people and that someone spots it and raises the alarm before it causes damage.

FAQ

What is the difference between social engineering and phishing?

Social engineering is the umbrella category: any manipulation of people to gain access, information or money. Phishing is one of its techniques, the one that uses email. Vishing by phone, smishing by SMS, quishing with QR codes and in-person impersonation are social engineering too.

What are the most common social engineering attacks against companies?

Phishing and spear phishing by email remain the most frequent, along with CEO fraud and supplier impersonation to divert payments. Attacks by phone and mobile messaging are gaining ground, and calls to the help desk to reset passwords or MFA have become a key vector against large companies.

Why do trained employees and technical staff fall for it too?

Because social engineering does not target a lack of knowledge but the context: time pressure, an authority figure, a story consistent with real information and a channel where nobody expects an attack. A pretext well prepared with OSINT can fool anyone at a bad moment. That is why effective defences do not depend solely on the person spotting it.

Does MFA protect against social engineering?

It helps a lot, but not all MFA equally. SMS or app codes and push notifications can be captured through a fake site or approved out of fatigue, while FIDO/WebAuthn, with security keys or passkeys, resists phishing. No MFA, however, stops someone from authorising a fraudulent transfer or the help desk from resetting it for an attacker.

Is it legal to run social engineering simulations on employees in Spain?

Generally yes, if it is planned properly: with management authorisation, an appropriate legal basis under data protection law, proportionality and a training-oriented, not disciplinary, use of the results. We cover how it fits with the GDPR, Spain's LOPDGDD and Spanish employment law in our guide on whether phishing simulations are legal.

How often should you measure resilience to social engineering?

As a guideline, at least twice a year, and more often in highly exposed companies or after significant changes such as mass hiring or a merger. More than frequency, what matters is varying channels and scenarios and comparing the report rate across campaigns.

What should you do if an employee falls for an attack?

First, they should report it immediately, without fear of reprisals. Then IT should change the affected credentials, revoke active sessions and review MFA methods and mailbox forwarding rules; if a payment was made, contact the bank as soon as possible to try to stop it. We explain it step by step in our guide on what to do if an employee falls for phishing.

Sources

Simulate a social engineering attack on my company