Social Engineering: Hacking the Human Instead of the Computer

The 30-second explanation

Instead of breaking through a firewall, the attacker calls, messages or shows up, and asks, convincingly enough to work, for exactly what they want.

How it works

1. 1

   1. Research

   The attacker learns names, job roles and everyday routines.

2. 2

   2. Pretext

   They pose as someone in that circle you'd naturally trust.

3. 3

   3. Pressure

   Urgency or borrowed authority pushes you to act before you check.

4. 4

   4. Ask

   A request small enough to seem harmless opens a much bigger door.

Attackers research who you actually work with, then pretend to be one of them: IT support, a manager, a supplier, someone from the delivery company downstairs. They build in pressure, a deadline, a problem, a name that outranks you, so you act before thinking it through. The request itself is usually small: reset a password, read out a code, hold a door open, open one file. It's the small yes that ends up unlocking the large breach.

Real-world example

How to spot it

• Unexpected urgency

  A deadline or threat that leaves no real time to check the story.

• Requests for codes or passwords

  Genuine support staff never need your one-time code to do their job.

• Unusual channel

  A request arriving through a route this person never normally uses to reach you.

• Flattery or authority

  Dropping an executive's name specifically to discourage questions.

What to do

1. 1Slow down and verify the person through a channel you already trust, such as a number from the official directory.
2. 2Never share a one-time code or password, no matter how convincingly someone asks for it.
3. 3Report suspicious contact even when you didn't fall for it, so colleagues get warned too.