In August we introduced phishing, the best known form of digital deception. This edition widens the view to the phenomenon phishing belongs to: social engineering. It explains what it is, why it works even on attentive people, which techniques it uses beyond email and which specific practice neutralizes each one.
What social engineering is and why it works
NIST, the U.S. standards institute and one of the most widely used technical references in security, defines social engineering as the act of deceiving an individual into revealing sensitive information, granting unauthorized access or enabling fraud, usually by building a relationship with them to earn their trust. The definition holds the central idea: the target is not the system, it is the person who has access to it.
That is why it requires no technical knowledge. It requires a believable story. INCIBE, Spain’s National Cybersecurity Institute, describes pretexting, meaning the creation of a fictitious scenario so that the victim shares what they normally would not, as the basis of any social engineering attack. The caller claims to be from the bank, a supplier, technical support or management, and everything else is built on that character.
The story works because it relies on predictable human reactions:
Authority.
A request that appears to come from an executive, an important client or an official body gets fulfilled with fewer questions. The attacker does not need to be that person, only to look like them for a few minutes.
Urgency.
A short deadline or an immediate consequence shifts attention from verifying to complying. Haste is not a detail of the deception, it is its main mechanism.
Trust.
Using a colleague’s name, mentioning a real project or showing knowledge of the team lowers suspicion. Much of that information comes from social media and public websites.
Benefit.
Free help, a prize or no-cost access create the feeling of receiving something, and with it the willingness to give something back.
Techniques beyond email
INCIBE groups the most frequent techniques. Several of them need no email at all:
Vishing.
A phone call in which the attacker poses as a trusted organization or person to obtain information.
The expected practice is to hang up and call back the official number you already know, never the one given during the call.
Quid pro quo.
A benefit, such as technical assistance, a gift or free software, is offered in exchange for information or access to the device.
The expected practice is to decline help that was not requested through internal channels.
Baiting.
A lure carrying malicious software, for example a USB drive left in a common area, which the victim plugs in out of curiosity.
The expected practice is not to connect devices of unknown origin and to hand them to the IT area.
Shoulder surfing.
Watching over someone’s shoulder to see what they type or have on screen.
The expected practice is to lock the device when standing up and to watch what stays visible.
Dumpster diving.
Searching the trash for documents with personal, financial or client information.
The expected practice is to destroy documents in the secure disposal bin.
The techniques change; the pattern does not. All social engineering combines a believable character, pressure to act quickly and a request that does not fit the channel or the moment. Recognizing that pattern is more useful than memorizing examples.
Trend of the month: artificial intelligence and impersonation
Artificial intelligence is changing the scale of social engineering. The ENISA Threat Landscape 2025, the annual report of the European Union’s cybersecurity agency, notes that by early 2025 AI-supported campaigns accounted for more than 80% of the social engineering activity observed worldwide. Messages no longer contain errors, are written in any language and adapt to each recipient in seconds.
The most significant shift is voice and image impersonation. The IBM Cost of a Data Breach Report 2026 identified deepfake impersonation, meaning falsified audio or video that imitates a real person, as the most frequent AI-driven attack of the year. On top of that, deception is moving away from email: according to the Verizon Data Breach Investigations Report 2026, 41% of breaches originating in social engineering used other vectors, led by phone and social media.
CISA, the U.S. cybersecurity agency, itself warned about calls in which criminals posed as its officials using real names and titles. Its advice applies to any organization: a legitimate entity never asks for money over the phone or for the conversation to be kept secret. When in doubt, hang up, write down the number and verify through the official channel.
Did you know?
62% of confirmed security breaches involve the human element.
(Verizon DBIR 2026).
About 60% of intrusions observed in the European Union started with phishing or one of its variants, including fraudulent calls.
(ENISA Threat Landscape 2025).
Business email compromise, which impersonates executives or suppliers to divert payments, caused losses of more than 3 billion dollars in 2025.
(FBI IC3 Internet Crime Report 2025).
The global average cost of a data breach has reached 4.99 million dollars.
(IBM Cost of a Data Breach Report 2026).
Read together, these figures point in one direction: the costliest attacks do not break systems, they convince people. The most effective defense is not technical either: pause, verify and report.
Tip of the month: clear desk and clear screen
Two of the techniques described, shoulder surfing and dumpster diving, need no technology: only information in plain sight. ISO/IEC 27001:2022 addresses them in control 7.7, which sets out two complementary requirements. Clear desk protects information on paper and on removable media: confidential documents, sticky notes, USB drives and external disks are locked away when leaving the desk and at the end of the day, and anything no longer needed is destroyed in a secure disposal bin, not the regular trash. Clear screen protects information in systems: the device is locked every time the desk is left, automatic inactivity lock stays enabled on desktops and laptops, and sessions are closed when work is finished.
The risk it mitigates is concrete: contracts, printed credentials or client data exposed to visitors, cleaning staff or anyone with access to the space. A single gesture covers half the control: Windows + L before you stand up.
Cybersecurity is not the exclusive responsibility of the IT area.
Every action counts toward keeping information secure.
