What Is Social Engineering? Examples and How to Spot It

Most scams do not break technology. They trick people. Social engineering is the name for that trick, and it works best when the attacker already knows a little about you.

By Siddharth ShankarUpdated October 18, 2026

Security systems keep getting stronger, so attackers often go around them by targeting people. A convincing email, a friendly phone call or a fake message from a colleague can achieve what hacking cannot.

What social engineering means

NIST describes social engineering as the act of deceiving a person into revealing sensitive information, obtaining unauthorized access or committing fraud. Put simply, it is manipulation, often by gaining someone’s trust first.

Common types

• Phishing: emails that pretend to come from a bank, delivery firm or service, asking you to click and log in. See phishing and smishing statistics.
• Smishing: the same trick by text message.
• Vishing: phone calls, often with a faked number. See caller ID spoofing.
• Pretexting: a made-up story, such as pretending to be IT support or a new colleague, to get information.
• Impersonation: pretending to be a family member, boss or official. The “hi mum” text scam is a well-known example.
• Baiting: offering something tempting, such as a free download, to get you to install malware or hand over details.

The pressure tactics to watch for

Social engineering relies on a few predictable levers:

• Urgency: act now or your account will close.
• Authority: the caller claims to be the police, the tax office or your bank’s fraud team.
• Familiarity: the message uses your name, your employer or a recent purchase.
• Fear or excitement: a problem to fix or a prize to claim.
• Secrecy: do not tell anyone, do not hang up.

Why your digital footprint matters

The more an attacker knows about you, the more believable the trick. Details from people-search sites, social media and data breaches let scammers mention your address, your children’s names or the bank you use. See how scammers get your phone number and email and what strangers can find about you online.

Simple habits that stop most attacks

If you think you were tricked

Change any password you shared, contact your bank straight away if money or card details were involved, and report the scam. If you gave away personal details, read what to do if your identity is stolen.

Real cases

Our incident reports show how these tricks play out, from fake bank calls to messages pretending to be a family member. See the case of the hi mum scam in Australia and courier fraud using fake police officers.

Teach the family one rule

Agree a simple family rule: nobody acts on an urgent request for money or codes until they have called the person back on a number they already know. It protects older relatives and teenagers alike.

Social engineering and AI

Attackers now use AI tools to write fluent messages and even imitate voices. That makes old warning signs, such as bad spelling, less reliable. The safest response is the same as always: do not act on the message itself. Verify through a separate, trusted channel before you click, pay or share anything.