What it is
Social engineering is the psychological manipulation of people to obtain access, data or money. It does not exploit technical flaws but trust, urgency, authority and curiosity. It is the basis of phishing, vishing, CEO fraud and many other attacks, and AI makes it more believable and cheaper.
How it works
- 1The attacker gathers public information about the person and the organisation.
- 2They build a believable pretext: the IT colleague, the supplier, the courier, the boss.
- 3They make contact by email, phone, chat or in person and create emotional pressure.
- 4They get the action they wanted: a credential, physical access, a transfer.
How to spot it
- Urgency, authority or secrecy used to make you skip procedures
- Unusual requests from people you know, or too much familiarity from strangers
- Offers or prizes too good to be true
- Information about you that a stranger should not have
How to defend
- Verification procedures nobody can skip, not even at the boss’s request
- Slow down: a pause before acting defuses almost any pressure
- Verify on a second channel with a contact you already know
- Build a culture where “let me verify first” is normal
- Regular training with real examples and simulations, and less personal information made public
If you think you have been hit
- Report at once, even if it is embarrassing: every minute counts
- Change the credentials you shared and tell IT or your bank
- Write down what happened: it helps block the attacker and protect others
And there are many, many more
The attacks above are only some of the most common: there are hundreds, and new ones appear every week. If the one that concerns you is not among them, write to me: I will tell you whether it really affects you and how to defend.
Contact meOther attacks
Watch the Shorts on YouTubeMatteo Russo · Updated October 2026