What Is Social Engineering: Pretexting, Vishing and Baiting Explained
Basics4 minInnovialabs editorial team
In short
Social engineering attacks people rather than systems: the attacker creates urgency or fakes authority so you hand over a code, access or a door yourself. The defence is the habit of pausing and verifying through your own channel.
The short answer
Social engineering is an attack on a person, not on software. Nobody needs to break encryption if an employee reads out an SMS code, holds a door open or plugs a found USB stick into a work laptop.
Phishing emails are the best-known variant, but far from the only one. Below are the techniques that work without a link in your inbox: over the phone, in person and through physical objects.
The main techniques
- Pretexting — a prepared cover story. "I'm new in IT and checking access rights", "I'm from the tax office and need to confirm your details". The story is backed by details from public sources: managers' names, project names, internal jargon.
- Vishing (voice phishing) — a call pretending to be your bank, a security team, a mobile operator or tech support. The classic: "Someone is trying to charge your card, tell me the code to cancel it." The caller ID can be spoofed to look official.
- Fake courier or technician — someone in a uniform with a parcel or a "repair ticket" who needs to get into the office, plug into the network or have you "sign on the tablet".
- Baiting — a USB stick labelled "Salaries 2026" in the car park, a free charging cable, a QR code on a flyer. Curiosity does the rest.
- Tailgating — following someone through a badge-controlled door while asking them to hold it because your hands are full.
- Quid pro quo — "I'm from support, I'll fix your email issue, just install this remote access tool."
The psychological triggers
| Trigger | What it sounds like | What it does |
|---|---|---|
| Urgency | "Your account will be blocked in 10 minutes" | Leaves no time to think or check |
| Authority | "This is the director, make the transfer now" | People hesitate to question the boss |
| Fear | "There is a case open against you" | Panic switches off critical thinking |
| Helpfulness | "Could you hold the door, please?" | Refusing feels rude |
| Curiosity and gain | "You've won", "Confidential file" | Wanting to know beats caution |
| Familiar details | Knows your name and part of your card number | Feels like an insider |
The common thread: the attacker wants you to act fast and emotionally instead of slowly and by procedure.
Verification habits that stop attacks
- Pause. Any urgency is a signal to stop. A real bank or manager can wait five minutes.
- Call back through your own channel. Hang up and dial the number on the back of your card or in the official app. Never call back a number the caller gave you.
- Codes are never read out to anyone. No bank, operator or "security team" asks for an SMS or push code. If they do, it is a scam.
- A second channel for money and access. Confirm payment or permission requests separately: a direct message in the company messenger or a call to a known number.
- Visitors only with an escort. Couriers leave parcels at reception; technicians come for tickets the office manager knows about.
- Unknown storage devices stay unplugged. A found USB stick goes to IT, not into a laptop "to see whose it is".
- It is fine to say no. Holding a door for someone without a badge is not politeness, it is a breach. A polite alternative: "Let me call reception for you."
What a company should do
- Write simple procedures: how payments are approved, who can reset passwords, how visitors get in.
- Run short, regular training with realistic calls and scenarios instead of one lecture a year.
- Make reporting a suspicious call easy and blame-free — one channel, no punishment for false alarms.
- Limit what staff share publicly about internal processes.
- Turn on two-factor authentication and least-privilege access so that one deceived person causes limited damage.
Common mistakes
- Believing only careless people fall for it. These attacks target tired and busy people, which means everyone.
- Trusting the number on the screen. Caller ID spoofing is technically possible.
- Verifying a caller with questions whose answers are on social media.
- Punishing an employee who admits a mistake. Next time they will stay silent.
FAQ
Phishing is one type of it, usually through emails and fake websites. Social engineering is broader: phone calls, in-person visits, physical baits and any scenario where a person is persuaded to break the rules themselves.