What Is Social Engineering? Definition, Examples, and Prevention

You’ve probably received an email that looked urgent, maybe from “your bank” or “IT support,” asking you to click a link or share a password. That’s social engineering in action—a method that preys on human instinct, not computer code. This guide breaks down what social engineering is, how it works, the most common tricks attackers use, and what you can do to stay ahead of the game.

Percentage of cyber attacks involving social engineering: 98% ⋅
Average loss per BEC attack: $130,000 ⋅
Most common attack type: Phishing ⋅
Term coined in cybersecurity: 1990s ⋅
Data breaches with a human element: 74%

Six key facts, one pattern: social engineering is about manipulating people, not breaking code. The table below pulls together the core definitions and data you need to understand the landscape.

What is social engineering?

The simplest way to think about social engineering is “human hacking.” Instead of searching for a software vulnerability, the attacker targets your trust, urgency, or fear. IBM defines it as a method that exploits human error or weakness rather than technical or digital system vulnerabilities (IBM (enterprise security)). The goal is to trick you into breaking normal security procedures, whether that means handing over a password, letting someone into a building, or transferring money.

What is a simple definition of social engineering?

“Social engineering is the art of manipulating people so they give up confidential information.”

Living Security (cybersecurity training provider) (Living Security’s social engineering guide)

In practice, that can be as simple as a fake email from “HR” asking you to update your payroll details. The trick relies on the fact that most people want to be helpful and avoid getting in trouble.

What best defines social engineering?

At its most precise, social engineering is a set of techniques that use psychological manipulation—such as authority, scarcity, and liking—to induce a person to perform an action or reveal information. Vectra AI notes that the attacker often researches the target first to build credibility (Vectra AI (network detection)). The defined outcome is always the same: unauthorised access.

The implication: organisations must treat human behaviour as a critical security layer.

What is an example of social engineering?

Real-world examples make the concept concrete. Below are the most common scenarios, ranging from digital to physical.

Which are examples of social engineering?

• Phishing emails – Spoofed messages from a legitimate-looking sender asking for credentials or payment. Phishing is the single most common type (Living Security).
• Pretexting – The attacker creates a fabricated scenario, such as posing as an IT technician, to obtain information (Vectra AI).
• Baiting – Leaving infected USB drives in parking lots or offering “free” downloads that actually install malware (ECCU (cybersecurity education)).
• Quid pro quo – Offering a service (“I’ll fix your computer”) in exchange for login credentials (Vectra AI).
• Tailgating – Physically following an employee into a restricted area without proper authorisation (Living Security).

What are social engineering examples in history?

One of the most famous historical examples is the 2013 Target breach, where attackers used a phishing email to a third-party HVAC vendor to steal the retailer’s network credentials and later access payment card data. More recently, CEO fraud (Business Email Compromise) cost companies over $2.7 billion in 2022, according to the FBI (IBM).

The pattern: real-world attacks show that social engineering often targets trust in established processes, not just individual gullibility.

What are the three basic types of social engineering?

Most cybersecurity frameworks group attacks into three core types, with a fourth often added. The table below shows the breakdown.

What are four types of social engineering?

Adding a fourth type—quid pro quo—makes the list more complete. In a quid pro quo attack, the hacker offers something desirable, like a free software tool, in exchange for access or data (Vectra AI). Some frameworks also include tailgating and vishing (voice phishing).

What is the most common form of social engineering?

Phishing is the most common form by far. According to the UK’s National Cyber Security Centre, phishing accounts for over 90% of data breaches involving a human element (IBM). The reason: it scales easily and costs attackers almost nothing.

The consequence: organisations should prioritise phishing-specific defenses above all other social engineering countermeasures.

How can social engineering happen?

Social engineering attacks follow a predictable chain: preparation, infiltration, and exploitation. Exabeam outlines this process in its 2025 threat analysis (Exabeam (security analytics)). Knowing the steps helps you spot the attack early.

1. Preparation: The attacker scrapes social media, company websites, or data leaks to build a profile.
2. Infiltration: They choose a medium—email, phone, in-person—and craft a believable story.
3. Exploitation: The victim performs the desired action (click, transfer, unlock).

What is social engineering attack?

An attack begins with reconnaissance: the attacker scrapes social media, company websites, or data leaks to build a profile. Then they choose a medium—email, phone, in-person—and craft a believable story. The final stage is exploitation, where the victim performs the desired action (click, transfer, unlock).

What are social engineering techniques in cyber security?

Beyond the basic types, attackers use sophisticated techniques:

• Impersonation – Posing as a colleague, vendor, or authority figure (Living Security).
• Scareware – Fake security alerts that urge the victim to install “protection” that is actually malware (Vectra AI).
• Watering-hole attacks – Compromising a website the target trusts to deliver malware (IBM).

The implication: a multi-layered defence that combines technology with awareness training is essential.

Who is the most famous social engineer in history?

When experts talk about social engineering history, one name comes up constantly: Kevin Mitnick. His attacks in the 1990s made him the most wanted computer criminal in the US at the time—not because of sophisticated code, but because he was a master manipulator (Exabeam (security analytics)).

What is another word for social engineering?

In cybersecurity circles, it’s often called “human hacking” or “social phishing.” IBM sometimes refers to it as “psychological exploitation” (IBM). Outside the tech world, it overlaps with terms like “con artistry” or “social manipulation.”

What is social engineering in politics?

The same techniques are used in political campaigns: targeted disinformation, fake social media accounts, and manipulated narratives designed to shift public opinion. The 2016 US election interference and Brexit disinformation campaigns are well-documented examples (IBM).

The takeaway: social engineering is a cross-domain threat that requires societal-level awareness, not just corporate training.

Timeline: The evolution of social engineering attacks

A quick journey through the milestones shows how the threat has grown from isolated hacks to an industry of its own.

• 1990s – Kevin Mitnick’s high-profile social engineering attacks bring the term to public attention (Exabeam (security analytics)).
• 2000s – Phishing becomes widespread; organised crime adopts social engineering for financial gain (Living Security (cybersecurity training)).
• 2010s – Business Email Compromise (BEC) surges; spear phishing targets executives and government officials (IBM (enterprise security)).
• 2020s – AI-powered social engineering (deepfake voice/video) emerges as a new, convincing threat (Vectra AI (network detection)).

The pattern: each decade adds a new layer of sophistication. What started as phone-based pretexting has evolved into AI-generated impersonations that can fool even careful employees.

Confirmed facts & what remains unclear

Not everything about social engineering is settled. Here’s what cybersecurity experts agree on—and where the data still has gaps.

Confirmed facts

• Social engineering exploits human psychology, not technical flaws (Living Security).
• Phishing is the most common type of social engineering attack (Living Security).
• Kevin Mitnick is a historically notable social engineer (Exabeam).
• Multi-factor authentication reduces the risk of credential theft (IBM).
• Defences include out-of-band verification, phishing-resistant authentication, and simulation training (Vectra AI).

What’s unclear

• The exact percentage of data breaches caused solely by social engineering varies by report (Living Security).
• The long-term effectiveness of AI-based social engineering detection is still being studied (Vectra AI).

What this means: while core principles are settled, the evolving nature of attacks means security teams must continuously reassess their defenses.

Expert perspectives on social engineering

Here’s how leading cybersecurity organisations describe the threat in their own words.

“Social engineering is the psychological manipulation of people into performing actions or divulging confidential information.”

IBM (enterprise security) (IBM’s enterprise security resource)

“Social engineering exploits human error rather than technical vulnerabilities. It’s sometimes called ‘human hacking.’”

Living Security (cybersecurity training) (Living Security’s social engineering guide)

“Social engineering is the art of manipulating people to give up confidential information. The types vary, but the goal is always the same: get the target to break security procedures.”

Vectra AI (network detection) (Vectra AI’s social engineering analysis)

“A social engineering attack follows a three-phase process: preparation, infiltration, and exploitation.”

Exabeam (security analytics) (Exabeam’s threat analysis)

Social engineering is not a single trick—it’s a constantly evolving playbook that adapts to new technologies and human behaviour. The one constant: it relies on our natural willingness to trust. For the individual reader, the implication is clear: make verification a habit before acting on any urgent or unexpected request. For organisations in the UK and EU, the regulatory direction (Digital Services Act, Online Safety Bill) will soon require stronger identity verification and reporting mechanisms. Investing in phishing-resistant authentication and ongoing training today isn’t just good security—it’s likely to become a compliance requirement tomorrow.

For a comprehensive breakdown of attack methods, this complete guide to social engineering attacks covers everything from phishing to pretexting.

Frequently asked questions

Related reading

• Is Temu Safe to Buy From? Risks, Safety Tips & Facts – Understand how online shopping platforms can be vectors for social engineering scams.
• Data Entry Jobs from Home: Real? Pay, Skills & How to Find Them – Learn to spot job offer scams that use social engineering to steal personal data.