You probably didn’t know the term, but chances are you’ve already been subjected to numerous social engineering attacks. With the rise of artificial intelligence (AI) and deepfakes, these attacks are getting increasingly sophisticated.

So, what is a social engineering attack, and how can you safeguard yourself against it?

What is Social Engineering?

Social engineering is a type of attack anchored on psychological manipulation, where attackers trick individuals into divulging confidential information or access to systems. In many cases, you’re tricked into believing that:

• The message comes from a person of authority or someone you trust.
• You have to take action immediately (there’s almost always a sense of urgency).
• You’ll suffer consequences if you don’t comply.

To help you visualize what a social engineering attack looks like, let’s examine their various forms.

Types of Social Engineering Attacks

Type	Method	Example
Phishing	Email	You get an email purportedly coming from your bank, asking you to reset your password
Spear phishing	Email specially crafted for you	You receive an email from your boss with accurate references to your workplace. If you have access to your company’s bank account, it may ask you to transfer funds
Smishing	Text message (SMS)	You receive a text message saying your package delivery is stuck and you need to pay additional fees for it to be forwarded
Vishing	Phone call	You’re contacted by someone pretending to be a tech support staff of a popular software, asking you access to your computer so they can fix a bug
Baiting	Something enticing	You see a USB stick labeled “confidential” on an airport bench
Pretexting	Fabricated scenario	You receive a call from someone pretending to be a staff from your HR department, asking for personal details
Tailgating	Physical intrusion by following someone	An attacker follows you into a restricted area in your organization and then pretends to forget their security badge
Quid Pro Quo	Fake benefit	A scammer offers you free software in exchange for access to sensitive information
Deepfake attacks	AI-generated audio or video	A deepfake video of your CEO instructs you to transfer funds to a fraudulent account

While there are many ways to deliver a social engineering attack, email is, by far, the most widely used delivery method. This is evident from the Verizon Data Breach Investigations Report:

In fact, almost 1.2% of all emails sent globally are malicious, translating to approximately 3.4 billion phishing emails daily.

In 2018, scammers used phishing emails and a cloned government website to steal $23.5 million from the U.S. Department of Defense by altering bank account information in the System for Award Management database.

This shows just how effective phishing can be as a social engineering tactic.

Common Techniques Used in Social Engineering

Although the medium of delivery may vary, most social engineering attacks employ the following techniques:

• Impersonation – The attacker may impersonate an organization or someone known to you, like your bank or your boss.
• Trust exploitation – The pretext or story is designed to gain and, ultimately, exploit your trust.
• Sense of urgency – Attackers always inject a sense of urgency to convince you to perform a desired action (e.g., share your password, transfer funds, allow entry into a secure area, etc.).
• Emotional manipulation – That sense of urgency is usually heightened by triggering extreme emotions, like fear, excitement, or curiosity.

How to Recognize Social Engineering Attempts

Since social engineering is designed to exploit the human psyche, you have the innate ability to protect yourself from it. But first, you must know how to identify a social engineering attack when you see one.

Here are some red flags that should tingle your spider sense:

• A sense of urgency – We know we’ve been hammering on this since the start of this article. However, once you notice urgency in a message, you should start looking for other signals that indicate a social engineering attack.
• Unusual requests – Be cautious if you’re asked to change your password, transmit funds, share personal information, or perform similar tasks when you least expect them.
• Inconsistent information – Poorly planned social engineering attacks usually contain conflicting information. If parts of the message don’t add up, be suspicious.

Once you see those signs, start looking for technical indicators. These can vary depending on the medium of delivery. For example, a phishing email may contain:

• A downloadable attachment
• A link to a webpage
• An unusual sender email address
• Misspelled domains (e.g., johndoe@yah00.com)

Countermeasures to Social Engineering Attacks

Here are some countermeasures you can perform when you recognize a potential social engineering attack:

• If it’s an email or text message, don’t click any link or downloadable attachment in the message.
• If you're at work and your organization has an IT or cybersecurity team, contact them immediately and share your suspicions.
• If you’re at home or working remotely, validate the source. For example, if it’s supposed to be your bank, call them using numbers from their official website.
• If it’s a call, end it and double-check through official channels.

Preventive measures

While avoiding social engineering attacks entirely can be difficult, you can minimize their occurrence. Here are two strategies you can employ:

• Don’t post sensitive information (e.g., credit card numbers, social security numbers, bank account numbers) online where they can be seen by the general public or by unverified or untrusted services.
• Minimize posting of personal information on social media. Cybercriminals can use that information to craft compelling social engineering messages or pretexts.

The more information attackers know about you, the better they can be in crafting their pretext messages. Therefore, to mitigate this threat, be more conscious of what you share in general.

The Importance of a Security Mindset

Gullible individuals are easy prey to social engineering. Thus, the best defense against this threat is heightened security awareness.

Once you know the threats surrounding you and can detect suspicious circumstances, it would be difficult for an attacker to influence and manipulate your emotions.

A security-first mindset is not developed overnight. It takes time, education, and training. And we don’t necessarily mean formal education.

There are several places online where you can find valuable tips that can help you develop security awareness, such as SANS Security Awareness Training, the National Cybersecurity Alliance, and the Cybersecurity & Infrastructure Security Agency (CISA).

Technological Solutions To Combat Social Engineering

While the most effective solution against social engineering is security awareness, you can augment it with security solutions or tools.

These tools can simplify and speed up the detection of indicators of cyber threats. Moreover, some social engineering attacks are so well-crafted that they can be difficult to recognize by mere human observation.

Here are some tools that can help you prevent, detect, or counter social engineering attacks.

Email filtering and anti-phishing tools

Email filtering and anti-phishing tools automatically detect and block potential phishing emails.

Gmail, for example, uses sophisticated algorithms that analyze incoming emails and filters them.

Go to your email spam folder. If you haven’t been checking that folder, you’ll be surprised to see the number of suspicious emails intercepted. It also goes to show how frequent these phishing attacks actually are.

Multi-Factor Authentication (MFA)

MFA, also known as 2-factor authentication (2FA) or 2-step verification, prevents attackers from gaining access to your account even if they manage to obtain your password through a social engineering attack.

For example, suppose you enable 2-step verification on your PayPal account. In that case, PayPal will ask you to submit a 6-digit security code from your chosen authenticator app (e.g., Google Authenticator or Microsoft Authenticator) in addition to your username and password.

If an attacker manages to steal your password through a phishing email, they would still be unable to login to your account without the security code.

To obtain that code, the attacker should have physical possession of your phone and, if your phone is locked, know your phone’s passcode.

That additional layer of protection can make a big difference in preventing a social engineering attack from succeeding.

Privacy Settings

Configuring your privacy settings is one way to prevent the unintended sharing of personal information on social media. You can set your privacy settings so the social media platform limits what you share and with whom.

Trends in Social Engineering

Social engineering has existed since the dawn of time. It was used to deceive victims before the internet, or even the computer was invented. That being said, it’s a threat that continues to evolve.

With the rapidly growing occurrence of generative AI (GenAI) terms alongside attack types in criminal forums, it’s easy to see how GenAI has found its way into social engineering attacks.

Chart created by OffGrid, data sourced from Verizon 2024 Data Breach Investigations Report

A quick search on Google Trends confirms the rising interest in AI and social engineering:

The two most prominent uses of AI in social engineering include:

• AI for personalization – Cybercriminals are increasingly using AI to scrape information from social media posts and craft more personalized messages.
• Deepfake images and videos – Cybercriminals are also using AI to create deepfake images and videos that make messages appear as if a known and trusted person delivered them.

In February 2024, Pepco Group, a major European retailer, fell victim to a sophisticated phishing attack, losing €15.5 million as fraudsters leveraged AI tools to spoof employee emails and deceive finance staff into transferring funds.

This demonstrates how AI in social engineering can enable cybercriminals to execute highly sophisticated and costly schemes.

Conclusion

Social engineering attacks thrive on exploiting human psychology, making them one of the most persistent and evolving threats. As attackers now leverage AI, deepfakes, and personalized tactics, heightened awareness and proactive measures are crucial.

The key to defending against these attacks lies in vigilance, education, and the right tools.

By recognizing red flags like urgency, unusual requests, and inconsistencies, you can often stop an attack before it causes harm. Pairing this awareness with technological solutions like email filtering, multi-factor authentication, and privacy settings creates a reliable defense.

Ultimately, the best protection against social engineering is a security-first mindset. Stay informed, question unusual requests, and use available tools to safeguard your information.