Social Engineering

• Social Engineering
  • Attacking the human, not the machine
  • Why it works: the psychology
  • The taxonomy of attacks
    • Phishing and its variants
    • Beyond the inbox
    • Scams and fraud
  • Business Email Compromise: where the money is
  • Worked example: dissecting a phishing email
  • Defending against social engineering
  • Key takeaways
  • References

Attacking the human, not the machine

Every other defense in this course — access control, cryptography, memory-safety mitigations — hardens the machine. Social engineering ignores all of it and attacks the person operating the machine. Why spend weeks finding a memory-corruption bug in a hardened, ASLR-protected server when you can email an employee a fake invoice and have them wire you the money — or hand you their password — voluntarily?

This is not a fringe technique. It is the most common entry point for real breaches. The overwhelming majority of incidents begin with a human being convinced to click a link, open an attachment, approve a login, or move money. An attacker who phishes one valid credential skips straight past the firewall, the VPN, and the patch cycle, and arrives authenticated. From there the host-attack lifecycle takes over.

The defining property of social engineering: the victim chooses to take the harmful action. There is no exploit in the software sense — the “vulnerability” is human psychology, and it does not get patched.

Why it works: the psychology

The reason social engineering is so durable is that it exploits cognitive shortcuts that are normally useful. Robert Cialdini’s principles of influence — written for marketing, but a near-perfect attacker playbook — explain why people comply. Recognizing the lever being pulled is the first defense:

Notice that urgency + authority is the recurring combination in nearly every phishing message: a powerful figure demanding immediate action. When you feel both at once in an unexpected message, that is the signal to slow down.

The taxonomy of attacks

Social engineering comes in many delivery channels, but the goal is always one of: steal credentials, deliver malware, or induce a payment/action.

Phishing and its variants

• Phishing — mass, untargeted fraudulent messages (usually email) impersonating a trusted brand to harvest credentials or deliver malware. High volume, low success rate, still wildly profitable.
• Spear phishing — targeted phishing using personal details (your name, manager, current project) for far higher credibility.
• Whaling — spear phishing aimed at a “big fish”: an executive, CFO, or sysadmin whose access or authority is worth the extra effort.
• Clone phishing — copies a legitimate message the victim already received, swapping a link or attachment for a malicious one.
• Vishing (voice) — phishing over a phone call; “this is your bank’s fraud department.” AI voice cloning has made this dramatically more convincing.
• Smishing (SMS) — phishing via text message: fake delivery notices, toll-payment scams, bank alerts.
• Quishing (QR codes) — a QR code in an email or on a poster routes the phone — outside corporate email filtering — to a phishing site.

Beyond the inbox

• Pretexting — inventing a believable scenario (“I’m from the vendor’s support team, verifying your setup”) to extract information or access. The backbone of vishing and most in-person attacks.
• Baiting — leaving malware-laden USB drives in a parking lot, or offering “free” downloads, relying on curiosity.
• Quid pro quo — offering a service in exchange for info (“free IT support if you just disable your antivirus for a moment”).
• Tailgating / piggybacking — physically following an authorized person through a secure door; carrying boxes so someone holds it open.
• Watering hole — compromising a website the target group is known to visit, so the victims come to the malware.
• MFA fatigue / prompt bombing — spamming a user with push-approval requests until they tap “approve” just to make it stop. (Defeated by number-matching and phishing-resistant FIDO2/passkeys.)

Scams and fraud

The same techniques drive consumer fraud at scale: tech-support scams (“your computer is infected, call this number”), romance scams, investment/”pig-butchering” scams, gift-card scams, and invoice fraud. These overlap heavily with the forensics privacy material and are reported to the FBI’s IC3.

Business Email Compromise: where the money is

Business Email Compromise (BEC) deserves its own section because it is, in raw dollars, one of the most damaging cybercrimes in existence — and it often involves no malware at all, just a convincing email. The attacker either spoofs or takes over a trusted email account (a CEO, a vendor, a real-estate title company) and instructs someone in finance to wire funds or change payment details.

The FBI’s Internet Crime Complaint Center (IC3) reported roughly $2.8 billion in BEC losses in 2024 alone, and nearly $8.5 billion across 2022–2024. It is consistently among the costliest categories in the entire report — outpacing ransomware in total dollars for years.

Common BEC patterns:

• CEO fraud — “I’m in a meeting, I need you to wire $48,000 to this account today, keep it confidential.” (Authority + urgency + secrecy.)
• Vendor/invoice fraud — a hijacked vendor account sends a real-looking invoice with changed bank details.
• Payroll diversion — an email “from” an employee asks HR to update their direct-deposit account.

The defense is almost entirely process, not technology: out-of-band verification (call the requester on a known number, never one from the email) and dual control / separation of duty for payments — the same access-control principle that requires two people to approve a wire.

Worked example: dissecting a phishing email

Email is trivially spoofable — the From: header is just text the sender types. The real provenance lives in the headers and in the three email-authentication checks (SPF, DKIM, DMARC). Most mail clients hide headers; “Show Original” / “View Source” reveals them.

Look at the Authentication-Results header the receiving server stamps on:

Authentication-Results: mx.pdx.edu;
       spf=fail (sender IP is 203.0.113.7)
          smtp.mailfrom=paypa1-billing.example;
       dkim=none;
       dmarc=fail (p=reject) header.from=paypal.com
Received: from unknown (HELO mailer.cheap-vps.example) (203.0.113.7)
From: "PayPal Service" <security@paypal.com>
Return-Path: <bounce@paypa1-billing.example>
Subject: Urgent: your account has been limited

Every red flag an analyst needs is here:

• spf=fail — the sending IP (203.0.113.7, a cheap VPS) is not authorized to send for that domain. SPF (Sender Policy Framework) is a DNS record listing who may send mail for a domain.
• dkim=none — no valid DKIM cryptographic signature. DKIM signs the message with the domain’s private key; the public key is in DNS.
• dmarc=fail (p=reject) — DMARC ties SPF/DKIM to the visible From: domain and publishes a policy. p=reject means PayPal told receivers to reject mail that fails — this message should never have reached an inbox.
• From: vs Return-Path: mismatch — the display says paypal.com; the actual bounce address is the look-alike paypa1-billing.example (note the digit 1 for the letter l).
• Urgency in the subject — the psychological lever.

You can inspect a domain’s published SPF policy yourself with dig:

$ dig +short TXT paypal.com | grep spf
"v=spf1 include:_spf.paypal.com include:pp._spf.paypal.com -all"
                                                            └ "-all" = hard fail
                                                              anything not listed

⚠️ SPF, DKIM, and DMARC are the technical backbone of email anti-spoofing — they are covered in depth on the Email Security page. Crucially, they stop an attacker from forging your exact domain, but they do not stop look-alike domains (paypa1.com), display-name spoofing, or a genuinely compromised account — which is exactly why BEC still works despite universal DMARC adoption.

URLs get the same scrutiny: hover (don’t click) to see the real target, watch for look-alike/homoglyph domains, sub-domain tricks (paypal.com.secure-login.example — the real domain is secure-login.example), and URL shorteners hiding the destination.

Defending against social engineering

Because the target is human, defense is layered across technology, people, and process — no single control is enough. This is defense in depth applied to the human attack surface.

Technical controls

• Phishing-resistant MFA — FIDO2 / passkeys cryptographically bind the login to the real site’s origin, so even a user who types their credential into a phishing page cannot have a valid second factor stolen. This is the single most effective control against credential phishing.
• Email authentication — publish and enforce SPF, DKIM, and DMARC (p=reject) so attackers cannot spoof your domain.
• Filtering & sandboxing — secure email gateways, link rewriting/detonation, and attachment sandboxing catch much of the volume.
• Least privilege — when a phish does succeed, least-privilege access control limits how far the stolen credential reaches.

Human controls

• Security-awareness training and simulated-phishing exercises — measurably reduce click rates, though they never reach zero.
• A blameless reporting culture — a prominent “Report Phish” button and no punishment for reporting (even after clicking) means the SOC hears about attacks in progress instead of victims hiding mistakes. Reporting speed is everything for incident response.

Process controls

• Out-of-band verification for any money movement or credential/account change — verify via a known channel, never by replying.
• Dual control / separation of duty for payments and privileged changes — the access-control principle that no single compromised person can complete a high-impact action alone.

Key takeaways

• Social engineering attacks the human, bypassing technical controls entirely; the victim is convinced to act, so there is nothing to “patch.”
• It works by exploiting normal cognitive shortcuts — Cialdini’s levers, above all authority + urgency. Feeling both in an unexpected message is the cue to slow down and verify.
• The family runs from mass phishing through spear phishing/whaling, across channels (vishing, smishing, quishing), to pretexting, baiting, and tailgating — and, at the costly end, BEC, which moves billions with no malware at all.
• Email is spoofable; provenance lives in the headers and in SPF/DKIM/DMARC — but those stop domain forgery, not look-alikes or account takeover.
• Defense is layered: phishing-resistant MFA and email authentication (tech), training and blameless reporting (people), and out-of-band verification + dual control (process).

References

• R. Cialdini, Influence: The Psychology of Persuasion — the six (later seven, adding Unity) principles. https://www.influenceatwork.com/principles-of-persuasion/
• FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report — BEC and phishing loss statistics. https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
• CISA, Avoiding Social Engineering and Phishing Attacks (ST04-014). https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks
• CISA, Phishing-Resistant MFA. https://www.cisa.gov/resources-tools/resources/phishing-resistant-mfa
• NIST SP 800-63B, Digital Identity Guidelines — Authentication (MFA and authenticator guidance). https://pages.nist.gov/800-63-3/sp800-63b.html
• APWG, Phishing Activity Trends Reports. https://apwg.org/trendsreports/
• RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC). https://datatracker.ietf.org/doc/html/rfc7489
• MITRE ATT&CK — Phishing (T1566). https://attack.mitre.org/techniques/T1566/

Related course pages: Identity and Access Management · Access Control and Authorization · Host Security and the Attack Lifecycle · Incident Response · Privacy

🛠️ Maintenance note: the BEC/phishing dollar figures are from the FBI IC3 2024 report (released April 2025) — refresh them when the next annual IC3 report drops. AI-driven voice/video deepfakes are rapidly changing vishing and whaling; revisit that section each term.