Social Engineering Attacks: Types, Examples and Prevention

Many social engineering attempts follow a recognisable sequence. An attacker adopts a credible identity or story, makes the contact feel relevant and asks the target to take a particular action.

Pressure, authority, secrecy, curiosity or familiarity may then make a normal check feel unnecessary, awkward or too slow. The request may be direct, but some approaches begin with harmless-looking questions and build trust over time. The NPSA describes both short approaches and longer relationships used to obtain information or access (NPSA, 2015).

The method used to influence someone is separate from the attacker’s objective. One attacker may want a password or account code. Another may seek payment, sensitive information, system access, physical entry or permission to work outside an established process.

Public information about roles, suppliers, projects or colleagues can make the story sound routine. Information from a compromised account can make it sound even more convincing. Plausibility does not establish that the person has authority for the requested action.

Social engineering can exploit normal workplace behaviour. Workplace norms often encourage employees to respond promptly, solve problems and respect legitimate authority. Attackers may exploit those behaviours when employees are under time pressure.

AI can help threat actors carry out existing social engineering tactics more efficiently, but employees should still verify the claimed identity, context and requested action. The identity, context and requested action still need an independent check (NCSC, 2025a).

Social engineering can be classified by contact route, attacker method or objective, and several types may be combined in the same attempt. In the UK Government’s 2025/26 Cyber Security Breaches Survey, 38% of businesses said they had identified phishing breaches or attacks and 12% reported impersonation breaches or attacks in the previous 12 months. Those figures describe two reported categories, not social engineering as a whole (DSIT and Home Office, 2026).

Social engineering categories overlap. A payment diversion attempt may begin with phishing, continue through a compromised account and rely on impersonation. Pretexting can support a phone call, a visitor request or gradual information gathering. Naming the approach can help employees describe it when reporting, but the immediate response should remain consistent across types. A consistent response is to verify the identity and request independently, follow the approved process and report concerns.

Employees should examine the requested action as well as how convincing the contact appears. A polished message, a correct job title or knowledge of an internal detail may support the story, but none proves identity.

A message that appears to come from a director asks an employee to send a sensitive file before a meeting and says no one else should be involved. Authority, urgency and secrecy can discourage an employee from questioning the request. The request falls outside the director’s usual role or approval route, so the employee verifies it using a known contact method and follows the normal information-sharing process.

A message from a familiar supplier account asks the finance team to change the bank details before an invoice is paid. The timing aligns with current work and the message looks routine, but the requested change falls outside the normal payment process. Finance checks the instruction with a known supplier contact and follows the approved change process to reduce the risk of payment diversion (Report Fraud, n.d.).

A caller asks for a verification code, or a visitor requests access to equipment for an urgent update. Technical language and a plausible manager’s name make the request sound informed. The employee does not share the code or admit the visitor. They contact the approved IT service through the internal directory or use the established visitor route.

A message from a colleague’s profile contains an unexpected link or QR code and asks the employee to verify or recover an account. The familiar profile may lower suspicion, but the request does not fit the colleague’s normal work. NCSC guidance warns that attackers may impersonate known contacts and request account codes through messaging apps (NCSC, 2026). The employee verifies the contact independently and reports the attempt.

A person met at an industry event asks about team names, systems and access arrangements across several conversations. Each question appears minor and no urgent request is made. A sequence of small questions matters because separate details can be combined. The employee follows the organisation’s information-sharing rules and checks with the designated internal contact before sharing work information.

Employees can examine seven elements of a request to decide whether it needs further verification, regardless of the channel.

A warning sign is a reason to pause and check, not proof that the contact is malicious. Modern scams may be polished and can mislead experienced people, so spelling, branding, caller ID, a display name or a familiar voice should not be treated as proof that the contact is genuine (NCSC, 2022).

• The contact, request or change in context is unexpected.
• The person creates pressure to act quickly, secretly or without consulting someone else.
• The person uses authority, familiarity or insider knowledge to discourage questions or checks.
• The request involves credentials, verification codes, sensitive information, money, system access, remote access or physical entry.
• The person asks to bypass an approval, callback, visitor, account-reset, payment or information-sharing process.
• The contact moves to an unusual or personal channel, or the request does not fit the person’s normal role or authority.
• Newly supplied contact details, altered payment details or a duplicate profile can make an identity check appear independent when it is not.
• A sequence of small questions or favours may gradually reveal more information or lead to greater access.

Several signs may appear together, but one high-impact request can justify a check even without obvious pressure. An attacker may sound patient, informed and helpful. A genuine contact may also make an unusual request for legitimate reasons. Independent verification can confirm whether the request is genuine without accusing the contact of wrongdoing. Employees should rely on the organisation’s verification procedures rather than the contact’s appearance or manner. The key question is whether the claimed identity, reason for contact and requested action match the organisation’s established procedures. Employees should not have to diagnose the attacker or prove malicious intent before asking for support.

A consistent response helps employees act when a request is unusual or difficult to verify. Employees can use three questions.

1. What am I being asked to do or disclose?
2. Does the request fit the person’s authority and our normal process?
3. Can I verify it through a trusted route that does not depend on the request itself?

Stop before completing an unusual, sensitive or high-impact action. Break contact where appropriate and use an internal directory, a known telephone number or address, an official website, an existing supplier record, an approved visitor route or an established approval process. Contact details, links or instructions supplied in the approach are not an independent check. Official UK guidance similarly advises people to stop and contact an organisation through details they know are correct (Stop! Think Fraud, n.d.).

Follow normal payment, access, account-reset and information-sharing procedures even when the request claims urgency, seniority or confidentiality. Never disclose passwords or verification codes. Before sharing other sensitive information, verify the request and recipient through the approved route.

Report the concern through the organisation’s established route. Employees should know that route before they need it. State what happened, the channel used, the requested action and whether anything was shared or completed. If action has already been taken, report it quickly and factually. The team assigned to handle the report can then direct the next steps. Certainty is not a condition of reporting.

Organisations cannot rely on every employee identifying every attempt. For phishing, NCSC guidance recommends layered defences that combine technology, processes and people, with user education as one part of the approach (NCSC, 2024). Although the NCSC guidance focuses on phishing, its layered approach can also inform controls for other social engineering risks. The aim is to make secure action practical during normal work and limit the effect of a mistaken response.

• Set a shared awareness standard that explains how attackers create pressure or trust across different channels, uses role-relevant scenarios and defines how employees should verify and report requests.
• Protect high-impact processes by requiring independent checks for payments, supplier-detail changes, account resets, privileged access, sensitive information and physical entry.
• Separate approvals and limit privileges so urgency, confidentiality or seniority cannot override essential checks.
• Use layered controls across email, web access, devices, permissions and authentication. Require strong, unique passwords and multi-factor authentication so one mistaken response does not automatically expose additional systems or information.
• Make reporting quick and safe by providing an accessible route, thanking reporters and giving feedback. Investigate incidents to learn and improve, not to blame someone for an innocent mistake (NCSC, 2025b).
• Review publicly available information that could strengthen an impersonation story, including information published by the organisation, staff, suppliers and contractors.
• Assign clear ownership so reports reach IT, security, finance or management quickly and trigger a defined response.

Check whether employees can find and follow the verification and reporting routes during routine work and under time pressure. A control may fail under pressure if trusted contact details are difficult to find or employees lack support to question a senior person’s request. Review reports, near misses and genuine requests that were hard to verify, then improve the process. UK employers should use cyber security awareness training to explain how employees must handle high-impact requests and which organisational process supports that response. Training should reinforce the controls people are expected to use, not compensate for unclear verification, difficult reporting or a process that allows an informal bypass.

Social engineering may use different contact routes, but attackers often try to make a request seem normal, familiar or urgent so that the target acts before checking it. A shared awareness standard tells employees to pause, verify and report suspicious requests across email, text, voice calls, messaging apps and face-to-face contact.

Human Focus Cyber Security Awareness Training is a CPD-certified, fully online course that takes 35 minutes or more to complete. It covers how cyber criminals exploit human behaviour through tactics such as social engineering, phishing and vishing, and explains employees’ responsibilities for following company policy and reporting attacks. Training should sit alongside the organisation’s technical, process and cultural controls.