What Is Social Engineering? How Cybercriminals Manipulate Your Employees

What Is Social Engineering? The Psychology of Cyberattacks

Social engineering is one of the most effective and underestimated threats to modern organisations. Unlike technical cyberattacks that exploit software vulnerabilities, social engineering exploits human psychology, trust, and natural instincts. Attackers use manipulation, deception, and psychology to trick employees into revealing sensitive information or granting unauthorised access.

At its core, social engineering recognises a fundamental truth: people are the weakest link in any security system. No firewall or encryption can protect against someone who willingly grants access or reveals passwords because they were manipulated into doing so.

The Psychology Behind Social Engineering

Social engineering attacks succeed because they exploit basic human psychology. Attackers use several psychological principles to manipulate victims:

Authority

People naturally comply with perceived authority figures. An attacker might impersonate an IT administrator, executive, or government official, using this authority to pressure victims into compliance. "This is urgent and requires your immediate action" carries more weight when it appears to come from someone in charge.

Trust and Liking

People are more likely to help those they like or trust. Social engineers build rapport through small talk, finding commonalities, or appearing professional and friendly. Once trust is established, victims are more willing to help.

Reciprocity

Humans feel obligated to repay favours. An attacker might offer help ("Let me assist you with that password reset") before requesting something in return ("Just confirm your current password first").

Urgency and Scarcity

Artificial time pressure clouds judgment. "Your account will be locked in 24 hours", "This opportunity expires today", or "We need immediate action" push victims to act without thinking.

Fear

Fear is a powerful motivator. Attackers use threats to manipulate behaviour: "If you don't comply, your job may be at risk" or "Your account has been compromised—verify now".

Consensus and Social Proof

People feel more confident making decisions when they believe others are doing the same. "Everyone in your department has already completed this security update" creates false pressure to comply.

Types of Social Engineering Attacks

Pretexting

Pretexting involves creating a false scenario or identity to manipulate victims. An attacker might call claiming to be from IT support troubleshooting a technical issue, building credibility by referencing internal systems or recent company events before requesting passwords or access information. The attacker has created a false context (pretext) to justify their request.

Baiting

Baiting offers something enticing (bait) that victims can't resist. A common example is leaving USB drives labelled "Executive Salary Information" or "Employee Bonus Details" in company parking lots. Curious employees plug in the drive, unknowingly installing malware. Another variant offers free downloads or tools that contain hidden malicious code.

Tailgating (Piggybacking)

Tailgating exploits physical security weaknesses rather than digital ones. An attacker follows a legitimate employee through a secure door, appearing to belong. They might be carrying a box or talking on a phone, creating an appearance of legitimacy. Once inside, they can access physical systems, plant malware, or steal equipment.

Quid Pro Quo

Quid pro quo attacks promise a service or benefit in exchange for information. "I can help you fix that software issue if you provide your login credentials", or "Call back your IT department using this number for a free security scan." The attacker promises value but either doesn't deliver or the offered service is malicious.

Phishing (as Social Engineering)

While often discussed separately, phishing is fundamentally social engineering. It exploits human trust and psychology rather than technical vulnerabilities, manipulating victims into revealing information through deceptive emails and websites.

Real-World Examples of Social Engineering Attacks

A Canadian financial services company experienced a significant breach through social engineering. An attacker called the company's support line, claiming to be a remote employee who lost their password. Using information gathered from LinkedIn and the company's website, the attacker provided convincing details about their "role" and "department". The support representative, convinced by the attacker's knowledge and authoritative tone, reset the password without proper verification. The attacker gained access and spent weeks exfiltrating sensitive customer financial data.

Another Canadian retail organisation fell victim to pretexting. An attacker called employees claiming to represent the company's payroll provider, stating there was an issue with direct deposit information. Employees, believing the call was legitimate, provided personal banking details. These details were later used for fraud.

A technology company experienced a breach when attackers left USB drives in the reception area labelled with internal project names. An employee, curious about the project, plugged in the drive on their computer. The USB contained malware that provided attackers with network access for months before detection.

How to Train Employees Against Social Engineering

Teach Recognition of Common Tactics

Employees need to understand the psychological principles attackers use: authority, urgency, fear, and trust. Training should include real examples of social engineering attacks and how the psychological principles were applied. When employees understand these tactics, they're more likely to recognise them when they occur.

Establish Verification Procedures

Create formal procedures for verifying unusual requests. If someone calls claiming to be IT support requesting passwords, the correct response is: "I'll verify this request independently by calling our IT department directly using the number on our internal directory." Never use contact information provided in suspicious communications.

Create a Reporting Culture

Employees should feel comfortable reporting suspected social engineering attempts without fear of punishment. Organisations that blame employees who fall for attacks create a culture where people hide incidents rather than report them. Instead, thank employees who report attacks and use them as learning opportunities for the whole organisation.

Use Simulated Attacks

Conduct controlled social engineering simulations. Send fake phishing emails or make pretexting calls to test employee awareness. Track who falls for the simulation and provide additional training to vulnerable employees. Research shows that employees who receive targeted training after failing a simulation show significant improvement.

Regular Awareness Training

Social engineering education must be ongoing. A single annual training session is insufficient. Monthly or quarterly refresher training, with variations in content and scenarios, keeps security awareness top-of-mind.

Role-Specific Training

Tailor training to different roles. Employees in reception or human resources are more likely to be targeted by pretexting or baiting because they interact with the public. IT support staff face authority impersonation attacks. Executives face sophisticated spear phishing and whaling. Training should reflect these specific risks.

Organisational Defences Against Social Engineering

Implement Strong Authentication Procedures

Require multi-factor authentication (MFA) for sensitive systems. Even if an attacker obtains a password through social engineering, MFA prevents unauthorised access. Never allow password resets based solely on verbal verification; require identity verification through multiple channels.

Develop a Clear Password Policy

Legitimate IT support will never ask for passwords. Create a culture where employees understand this is a security rule, not a guideline. If IT support needs access, they should use administrative accounts rather than requesting employee passwords.

Control Physical Access

Implement badge access systems with turnstiles that prevent tailgating. Use cameras in secure areas to deter unauthorised access. Train staff not to prop open doors or allow people to follow them through security checkpoints.

Monitor for Suspicious Behaviour

Watch for signs of social engineering: employees requesting unusual access, unknown people asking questions about systems, or unusual login patterns. Sonark's monitoring solutions help organisations detect suspicious activity patterns that indicate social engineering in progress.

Create Incident Response Procedures

Define clear steps for employees to take if they suspect they've been targeted by social engineering. This might include immediately reporting to IT, changing passwords, and not taking further action until verified by management.

Building a Security-Conscious Culture

The most important defence against social engineering is cultivating a culture where security is everyone's responsibility. This means:

Leadership must model security awareness and prioritise security. When executives follow security procedures, employees take them seriously. Leadership should also celebrate employees who report social engineering attempts, reinforcing that reporting is valued.

Security should be integrated into regular communications. Monthly newsletters, team meetings, or digital signage can highlight security topics and reinforce awareness.

Provide employees with clear, accessible resources. When employees have questions about security, they should know who to contact and how to verify requests independently.

The Role of Cybersecurity Partners

Many organisations supplement internal training and defences with external cybersecurity support. Security awareness training programmes, threat intelligence, and monitoring can significantly improve an organisation's resilience against social engineering.

Protecting Your Organisation from Social Engineering

Social engineering attacks continue to evolve, but organisations that invest in employee training, establish strong verification procedures, and build a security-conscious culture can dramatically reduce their risk. The combination of technical controls and human awareness creates powerful defence against manipulation.

For comprehensive support in defending against social engineering and other cybersecurity threats, contact Sonark to discuss how our training and monitoring solutions can protect your Canadian SMB. Get in touch with our team to develop a social engineering defence strategy tailored to your organisation's unique risks.