Preventing Social Engineering

Social engineering tricks people into giving away information or access, so technical defences alone cannot remove the risk: a firewall can block a connection, but no software can decide whether you should trust a message asking you to confirm a password. The risk is reduced in two ways: training users to be suspicious of unexpected requests, and checking any request through an official, known contact.

Training users to be suspicious

Teach users that an unexpected request for information is a warning sign. It may arrive by email, text message, phone call or face to face. If you did not start the contact and the person wants a username, password, payment details or permission to access a device, do not give it straight away. A simple habit helps: stop, treat the request as suspicious and check it before acting. Attackers depend on a quick reply, so a moment's pause is a real defence.

Checking with an official, known contact

A request might still be genuine, so confirm it using a contact detail you already hold, never one given in the request. For example, a message claims to be from your local library and asks you to confirm your account password for a system upgrade. Do not reply to it. Instead, phone the library on the number printed on your library card and ask whether the request is real. In the same way, staff can be told to ring the IT helpdesk using the internal phone list before acting on an email that asks them to reset a password.

Why both steps matter

The check has to use a separate, official route because the attacker controls the email address or phone number shown in the original request. Regular training with realistic examples of unexpected requests, plus a safe way to confirm them, makes it much harder for an attacker to persuade someone to hand over information.