What Is Social Engineering? 8 Attack Types and How to Defend Against Them

What is social engineering?

Social engineering in security means tricking people, rather than breaking technology. The goal is to get them to hand over access, information or money. A social engineering attack plays on normal human instincts such as trust, helpfulness, fear and urgency. The attacker does not need to beat your firewall if someone inside will open the door for them.

It is one of the most common ways breaches start. The Verizon Data Breach Investigations Report (DBIR) is a large yearly study of real breaches. It has often found that the human element is involved in a majority of breaches. That includes social engineering, stolen passwords and mistakes.

Why social engineering attacks work

Good social engineers do their homework. LinkedIn, company websites, press releases and job ads tell them a lot. They learn who works where, who approves payments and which tools you use. Then they pull a few reliable levers:

• Authority: the request seems to come from the CEO, IT, a bank or a regulator.
• Urgency: there is no time to check, so the target acts first.
• Familiarity: they use real names, real projects and real suppliers.
• Helpfulness: help desk and finance staff are trained to solve problems quickly.
• Fear or curiosity: a security alert, a salary file, a missed delivery.

That gives you a simple test any employee can use. Does a message or call push you to act fast? Does it ask you to skip a normal step? Does it involve access, data or money? If so, stop and check through a channel you already trust. Real colleagues and suppliers will wait five minutes while you check. Attackers usually will not, and that impatience is itself a warning sign.

8 types of social engineering attacks

1. Phishing. Mass emails that pretend to be a trusted brand or service. They aim to steal logins or deliver malware (harmful software). See how to spot a phishing email for the red flags.

2. Spear phishing. Phishing aimed at one person or team. It uses researched details such as a real project name or a real supplier. When it targets senior executives it is often called whaling.

3. Vishing and help desk impersonation. Voice phishing by phone. A common business version is a caller who poses as a locked-out employee. They ask the IT help desk to reset their password or MFA (the second login step, such as a code on your phone).

The 2023 attack on MGM Resorts is widely reported to have begun this way, with a call to the IT help desk. It caused major disruption across the company's hotels and casinos. MGM later said in a regulatory filing that it expected the incident to hit its quarterly results by around $100 million.

4. Smishing. Phishing by text message. Examples are fake delivery notices, bank alerts or messages that seem to come from a manager's personal number.

5. Pretexting. The attacker builds a believable story first: a new auditor, a supplier's account manager, a recruiter. The story makes the later request feel routine.

6. Baiting. Leaving something tempting for the victim to pick up. Think of a USB stick labeled "Payroll" in the parking lot, or a free download that carries malware.

7. Tailgating. Following an employee through a secure door, often while carrying boxes or claiming to have forgotten a badge.

8. Business email compromise (BEC). Using a hacked or faked email account to redirect payments, usually by posing as an executive or supplier. The FBI's Internet Crime Complaint Center (IC3) ranks BEC among the costliest types of cybercrime reported to it, year after year.

How to defend against social engineering

You will not train every risk away. The goal is to make each attack harder to pull off and less harmful when it works. That takes three layers.

Process. Write down the rules that attackers hope you do not have. Payment changes are checked by phone. The help desk never resets MFA based on a phone call alone. Visitors are always escorted. Then back staff who follow the rule, even when the "CEO" is annoyed.

Technology. Use phishing-resistant MFA such as passkeys, which fake sites cannot steal. Add email checks (SPF, DKIM, DMARC) that block fake senders, and banners that flag outside email. Control USB devices and use badge access on doors. Each one removes an option the attacker would otherwise have.

People. Short, regular training with realistic examples, and a simple, blame-free way to report anything odd. A culture where checking is normal beats any slide deck.

The table below matches each attack type to the defense that works best against it.

Test your defenses before attackers do

Policies look good on paper. Does your help desk follow its reset steps? Do staff challenge a stranger at the door? The only way to know is to test them. Approved social engineering tests include practice phishing emails, vishing calls to the help desk and attempts to walk into the building. They run under a written scope agreed in advance.

For casino and online gaming operators, where the MGM case hit close to home, see our iGaming security work.

How NextGarrison helps

We run social engineering tests as part of our penetration testing (expert attempts to break in). They cover phishing, vishing and help desk testing. We turn the results into practical process fixes and training. Our 24/7 SOC, a team that watches for attacks around the clock, then looks for the account takeovers that follow a successful attack. See our services or ask about a social engineering test.