# Social engineering

> Manipulating people, instead of machines, into giving away access or information.

- Level: Basic
- Topics: Security
- URL: https://tidbit.legios.com.ar/social-engineering/
- In Spanish: [Ingeniería social](https://tidbit.legios.com.ar/es/social-engineering/)

**Social engineering** is the art of getting what you want from a system by working on the people around it. Instead of breaking encryption or finding a bug, the attacker convinces someone to share a password, read out a verification code, approve a payment or hold a door open. Phishing is its most common form, but it also happens by phone, in person, through social networks and in messaging apps.

The tricks lean on ordinary human instincts. **Authority**: 'This is your bank's fraud department' or 'the CEO needs this transfer today'. **Urgency**: 'your account will be closed in one hour'. **Helpfulness**: a new 'colleague' who forgot their badge. **Curiosity or fear**: a USB stick labeled 'salaries' left in the parking lot. A carefully built cover story is called **pretexting**; a fraudulent phone call is **vishing** (voice phishing).

It works on smart, careful people because it does not attack intelligence; it attacks routine and good manners. The attacker often does homework first, using public information from LinkedIn or a company's website, so the story includes real names and details. Voice cloning and convincing fake messages make the stories even more believable.

The defense is mostly process. Verify requests through a separate channel you already know, such as calling back the official number or asking the person face to face. No real support team needs your password or the code a service just texted you. In companies, clear rules help: payments to new bank accounts need a second approval, and nobody gets punished for slowing down to check.

## An analogy

A con artist in a hotel lobby who never touches a lock. With a confident smile and a believable story about a lost key card, he gets the receptionist to hand him a new one.

## Keep in mind

- It targets people's trust, habits and good manners, not the technology.
- Authority, urgency, helpfulness and fear are the usual levers.
- Verify any unusual request through a channel you choose, not the one offered.
- Never share passwords or one-time codes, whoever asks.

## Go deeper

- [Avoiding social engineering and phishing attacks (CISA)](https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks)
- [Social engineering on Wikipedia](https://en.wikipedia.org/wiki/Social_engineering_(security))

## Related terms

- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [Bug](https://tidbit.legios.com.ar/bug/): A mistake in software that makes it behave differently from what was intended.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.
- [USB](https://tidbit.legios.com.ar/usb/): The standard plug for connecting and charging almost everything.