Social engineering: definition, techniques, and examples

Social engineering is the art of manipulating a person into giving up information, access, or an action they would not grant if they thought it through. The attacker does not break a system: they convince someone to open the door. It can happen by email, text, phone call, or in person.

This article covers the definition, the main techniques, example scenarios, the psychological levers behind them, the signs that should make you stop, and how to train a team. It extends our guide to security awareness training and vishing practice.

What is social engineering? The definition

NIST defines it as the act of deceiving an individual into revealing sensitive information, obtaining unauthorized access, or committing fraud, by gaining the person's confidence and trust. CISA, the US cybersecurity agency, describes an attack in which the attacker uses human interaction to obtain or compromise information about an organization.

The word “engineering” can mislead: nothing about the target is technical. What gets attacked is a human decision, made fast, under pressure, with good intentions.

That is why these attacks work. According to the 2025 activity report of Cybermalveillance.gouv.fr, the French national cyber victim assistance service, more than 500,000 requests for assistance were recorded, up 20% from 2024. A firewall does not protect against an employee who reads out a code in good faith.

The main social engineering techniques

Techniques differ by channel and by pretext. The principle stays the same: build a situation in which the person complies.

• Pretexting: the attacker invents a credible role and story, such as an auditor, a vendor, or a new colleague, to extract information.
• Phishing: an email or fake website that imitates a trusted organization to collect credentials or get a click. Our article on the definition of phishing covers it in detail.
• Vishing: the same maneuver by voice, over the phone. See the definition of vishing. CISA notes that the caller ID can be spoofed.
• Smishing: phishing by text message, with a link or a number to call back.
• Baiting: the attacker leaves a lure, such as a “lost” USB drive in a parking lot or an offer that looks too good, to push someone into using it.
• Tailgating: someone enters a building by following an employee who holds the door, often because they are carrying a package or a coffee.
• Quid pro quo: a “favor” in exchange for information. A fake technician offers to fix a computer problem in exchange for a password.
• Impersonating a help desk or an executive: the attacker poses as the help desk, the leadership team, or the bank. See CEO fraud and social engineering aimed at the help desk.

Social engineering examples (typical scenarios)

The three situations below are illustrative scenarios built for this article. They do not describe real cases.

The fake IT support caller

Imagine a call to an executive assistant. A man introduces himself as IT support and reports an alert on her computer. To “fix” it, he asks for her password, then for the code she just received by text. The pretext is plausible, the department really exists, and the help was offered without her asking.

The fake executive

A treasury manager gets a message, then a call, from the “CFO.” A confidential acquisition requires a wire transfer within the hour, and he must not tell anyone. Every element discourages checking: authority, urgency, secrecy.

The fake bank advisor

A small business owner is called by a supposed advisor from her bank. A suspicious transaction is in progress, it must be blocked now, and to do that she has to confirm a code received by text. The code blocks nothing: it approves the attacker's transfer. Our article on the fake bank advisor scam method walks through this sequence step by step.

The psychological levers behind these attacks

Psychologist Robert Cialdini describes in Influence six principles that steer our decisions: reciprocity, commitment and consistency, social proof, authority, liking, and scarcity. Fraudsters apply them to a short conversation, with a script written in advance. On the phone, six levers come up almost every time.

• Urgency: “You need to act within ten minutes.” Any deadline imposed by the caller is suspect. Response: “I'm going to verify, and I'll call you back in five minutes.”
• Authority: a title, a department, a badge number. A title takes one second to say and proves nothing. Response: “I'll call back on the official number.”
• Guilt: “You're the one holding up the whole team.” Do not justify yourself: “I understand. The procedure still applies.”
• Reciprocity: help you did not ask for, followed by a request. A real security team does not ask for anything in return.
• Small asks: a series of harmless steps, the last of which is enough to approve a payment. Judge the purpose of the request, not the size of each step.
• Isolation: “Don't tell anyone.” This is the most reliable signal: no legitimate department forbids you from checking with your colleagues.

A fraudulent call often combines three or four of them in under two minutes. Naming the levers in your head, one by one, breaks the pressure.

How to recognize a social engineering attempt

Whatever the channel, a few signs come back. None is enough alone, but two or three together justify stopping.

• An unusual request: a code, a password, a transfer, or access, outside the normal procedure.
• Time pressure imposed by the other person.
• A request for secrecy: don't tell anyone, don't call back.
• A channel that changes: the conversation moves from email to phone, or from one number to another.
• An accurate detail that reassures wrongly: a name, a department, a case number. These often come from public sources and do not prove identity.

When in doubt, CISA recommends contacting the organization directly using contact details from a previous statement, never those in the message. That is the idea behind the callback through an independent channel. For the questions to ask before calling back, see how to verify a caller's identity.

How to train teams to resist it

Knowing the list of techniques helps. It does not guarantee you will spot them live: on the phone, the brain is busy with the conversation, the wish to be polite, and the fear of getting it wrong. The easiest behavior, which is to comply, takes over.

A reflex is built like any skill: by repeating it in conditions close to the real thing. That is the principle of role-play. The learner speaks out loud, feels the pressure, tries a phrasing, fails, and starts again. Our article on how to say no on the phone under pressure covers the phrasings that hold.

With Face Up, a trainer writes a scenario from a real call experienced in their organization. A persona played by an AI takes the caller's role, chains the levers, and reacts to the learner's answers, by voice or video. After the session, a debrief shows what held, what gave way, and quotes the phrases spoken. The learner can replay. To understand the principle, see our explanation of AI role-play.

Frequently asked questions

What is social engineering, in one sentence?

It is the set of manipulation techniques that push a person to disclose information, grant access, or take an action, by exploiting trust and pressure rather than a technical flaw.

Does social engineering only involve phone calls?

No. It happens by email, text, messaging apps, and in person (tailgating, fake contractors). The phone gives it an edge, though: a voice inspires trust, and the pace of the exchange prevents checking.

What is the difference between social engineering and phishing?

Social engineering is the family, and phishing is one of its techniques. Phishing uses a written message or a fake site, vishing uses voice, and smishing uses text messages.

What should I do if I already gave in?

Act right away: alert the relevant team, block whatever can be blocked, and note the details of the exchange. Feeling guilty must not delay the report. Write down the time, the number shown, and the phrases you heard.

To train your teams to spot these techniques out loud, explore Face Up role-plays or book a demo with our team.