Why Social Engineering Works

Social engineering works because it goes around the technology and aims straight at you. It is a way of manipulating people, not a piece of software. Anti-malware can spot a suspicious file and a firewall can block traffic from a dangerous address, but neither can spot a convincing lie, so attackers target the person rather than the machine.

The human qualities attackers use

Almost every attack leans on an ordinary human quality:

• Trust — you believe someone who sounds official or familiar.
• Fear — you act quickly to avoid losing money or access.
• Curiosity — you open something just to find out what it is.
• Politeness — you help someone who asks nicely instead of being rude.
• Carelessness — you are tired, busy or distracted and skip a check.

None of these is a fault in the software. A visitor with an armful of folders asks you to swipe your card so they can follow you through a locked door: politeness does the work, and no program is involved.

Pressure stops you checking

Attackers add a reason to act now. Urgency and fear shrink the time you have to think, such as a message saying an account closes in ten minutes. An offer that seems too good to be true, like a games console for a tenth of the price, works the same way, because wanting it overrides the small voice asking whether it is real. The aim is not to make you believe something ridiculous, but to stop you pausing long enough to check.

Why technical defences miss it

Anti-malware and firewalls block things trying to get in, but in social engineering the victim lets the attacker in: you type the password into the fake page yourself, or read out the code. Nothing was broken, so nothing gets blocked. Software also struggles to judge a message that is technically ordinary but wrong in its intent.

Attacks like these are often combined. A single message might offer a prize, warn that an account is about to close and demand a reply within minutes, so the same attack could be given more than one technique name. What matters is judging the request itself, not the label.