Social engineering, when the attack targets the person, not the machine

A system that's technically flawless can fall in minutes, with no software flaw exploited at all. All it takes is one person, on the inside, being convinced to open the door themselves. That's the principle behind social engineering: instead of attacking a computer, you attack the person using it.

What social engineering actually is

Social engineering covers every technique that manipulates a person into doing something they'd never do after thinking it through calmly: revealing a password, clicking a link, plugging in an unknown USB drive, letting a stranger into a secured building, or wiring money to an account they don't recognize. Phishing (see the dedicated article) is its best-known form, but it's only one technique among several in the same family. All of them share the same starting principle: it's often far faster and far more discreet to manipulate a person than to get past a firewall or find an unknown software flaw.

This difference has a direct consequence: no update, no antivirus, no firewall protects against social engineering, since none of it targets a computer system at all. The only effective protection runs through the person themselves, and the habits they've built up, regardless of their technical skill otherwise.

The psychological levers it exploits

Social engineering techniques almost all rest on a small number of psychological levers, well documented in sociology and marketing long before being applied to information security.

• Authority: a message or call presenting itself as coming from a boss, a police officer, or official tech support pushes people to obey without questioning it, out of hierarchical reflex.
• Urgency: "this account will be closed in 24 hours," "this offer expires in 10 minutes." Urgency stops you from taking the time to verify, which remains the best defense against almost all of these techniques.
• Likability: a warm, polite attacker who makes small talk before asking for anything gets a favor far more easily than a cold, blunt message.
• Social proof: "all your coworkers already filled out this form" pushes people to go along without checking for themselves.
• Scarcity: presenting access or information as exceptional, exclusive, or time-limited pushes people to act before thinking.
• Reciprocity: doing a small favor, real or apparent, before asking for something in return creates a sense of debt that pushes people to say yes.

None of these levers is specific to computing. They're ordinary social mechanisms, at work every day in perfectly legitimate contexts: sales, negotiation, everyday politeness. Social engineering simply redirects them toward a malicious goal.

Pretexting: building a credible character

Pretexting means inventing a full, credible scenario to justify a request, rather than hoping a generic message will be enough to convince someone. An attacker might, for instance, call a company's accounting department pretending to be a regular supplier, with the right contact name and the right invoice reference, gathered beforehand from a professional network or an earlier data breach, to request a change of bank details on the next payment.

Unlike phishing sent en masse to thousands of recipients, pretexting takes real preparation: studying a company's org chart, its usual suppliers, the internal vocabulary used day to day. That preparation makes the story all the more convincing because it contains exact details a generic message would never have. It's exactly the same logic as the spear phishing described in the article on phishing, applied this time to a phone call or an in-person meeting rather than an email.

Baiting, or why a USB drive found on the ground should never be plugged in

Baiting relies on curiosity rather than urgency or authority. The best-documented version involves deliberately leaving infected USB drives in a parking lot, a lobby, or a break room at a targeted company, sometimes with a label designed to maximize the odds it gets plugged in, like "2026 Salaries" or "Confidential photos." Experiments run on this exact scenario show that a significant share of drives left this way end up plugged into a work computer, often within a few hours.

A booby-trapped USB drive needs no further action from the victim beyond simply plugging it in to install a trojan or open remote access (see the article on malware for what this kind of software can then do once installed). The safest rule remains never plugging in a storage device found or received from an unknown source, even out of simple curiosity, "just to see what's on it," and reporting it to the IT department instead, if one exists.

Tailgating, the social engineering played out in person

Tailgating (sometimes called piggybacking) means physically following an authorized person through a badge-secured door, without having the right to enter yourself. The simplest technique often remains the most effective: carrying visibly heavy boxes, or simply walking confidently right behind someone who just badged in, counting on the natural politeness that makes people hold a door rather than close it on a stranger. A maintenance worker's uniform, a visible but never closely checked visitor badge, or simply looking like you're in a hurry are often enough to disarm any suspicion.

Once inside, an attacker who's successfully tailgated in can plug a device directly into the internal network, access a workstation left unlocked, or simply observe and photograph sensitive information left visible on a desk or screen. This is one of the reasons companies that take security seriously train their staff to never hold a secured door open for someone they don't personally recognize, even at the cost of an awkward social moment.

Why it works even on careful people

Social engineering doesn't target technical incompetence; it targets perfectly normal social reflexes: politeness, trust in apparent authority, the urge to help a struggling coworker, the fear of missing something important. Someone can know the risks of phishing perfectly well on paper, and still be vulnerable to a well-built phone call on a day when they're in a rush, tired, or simply caught off guard by an unusual situation.

This is exactly why the best defense isn't "being more careful" in general, an intention too vague to be reliable in the moment, but applying concrete, systematic habits, always the same ones, regardless of how tired or stressed you are at the time.

How to protect yourself, in practice

• Verify any sensitive request (a bank detail change, an access request, a password) through a channel independent of the one used for the request itself: call back a number known in advance, never one given by the caller.
• Never plug in a storage device found or received from an unverified source.
• Never hold a secured door open for someone you don't personally recognize, even if it feels rude in the moment.
• Be especially wary of any urgent request, whether it comes by email, phone, or in person: urgency is the most consistently used lever, across almost every variant covered above.
• Limit the personal or professional information shared publicly, which directly fuels pretexting and spear phishing.
• Remember that no legitimate service (bank, tech support, or government agency) ever asks for a full password or a two-factor code by phone or email (see the article on two-factor authentication to understand why that particular code should never be shared, even with someone who seems legitimate).

Social engineering doesn't really have a technical fix, because it doesn't target the technical side. Slowing down before acting, verifying through an independent channel, and accepting that an awkward social moment beats leaving a door open to the wrong person remain, even today, the only protections that actually work against manipulation.