Social engineering

Social engineering is the art of getting what you want from a system by working on the people around it. Instead of breaking encryption or finding a bug, the attacker convinces someone to share a password, read out a verification code, approve a payment or hold a door open. Phishing is its most common form, but it also happens by phone, in person, through social networks and in messaging apps.

The tricks lean on ordinary human instincts. Authority: 'This is your bank's fraud department' or 'the CEO needs this transfer today'. Urgency: 'your account will be closed in one hour'. Helpfulness: a new 'colleague' who forgot their badge. Curiosity or fear: a USB stick labeled 'salaries' left in the parking lot. A carefully built cover story is called pretexting; a fraudulent phone call is vishing (voice phishing).

It works on smart, careful people because it does not attack intelligence; it attacks routine and good manners. The attacker often does homework first, using public information from LinkedIn or a company's website, so the story includes real names and details. Voice cloning and convincing fake messages make the stories even more believable.

The defense is mostly process. Verify requests through a separate channel you already know, such as calling back the official number or asking the person face to face. No real support team needs your password or the code a service just texted you. In companies, clear rules help: payments to new bank accounts need a second approval, and nobody gets punished for slowing down to check.