Social Engineering

Social engineering is tricking a person into revealing sensitive information, such as usernames, passwords or personal details. Instead of attacking the technology, the attacker tricks a person into handing over a way in.

It works because people are helpful and because they trust anyone who sounds official or who appears to be in trouble. A social engineer often impersonates someone — a delivery driver with a parcel for a named member of staff, a contractor checking fire alarms, or a quiz organiser collecting entry forms. A small request from someone who seems to belong is hard to refuse, especially if it is framed as urgent.

How it reaches you

Phishing is a type of social engineering.

The victim may not notice

If social engineering succeeds, the victim often does not realise they have revealed anything. No lock was forced and no password was guessed, because the details were handed over willingly and the request seemed ordinary. Often the person only finds out later, when an account starts being used by someone else or a payment appears that they never made. That delay gives the attacker time to use the information before the password is changed.

Tailgating

Tailgating, also called piggybacking, is a face-to-face social engineering technique in which an unauthorised person follows an authorised person into a restricted area. For example, at a leisure centre, a swimmer without a coloured wristband walks through the poolside gate behind a family who scanned theirs. The gate records one family entry, so the system shows nothing unusual, and nobody questions a person who is already inside.