Social engineering: what it is and how to recognise an attack on an employee

Social engineering is the manipulation of a person so that they themselves hand over confidential information, let a stranger in or carry out an action that harms their company, such as a bank transfer or installing a program. The attacker does not break technical safeguards; instead they exploit trust, haste and the wish to help. Below you will find the most common social engineering techniques with office examples, warning signs and exercises that prepare your team as part of cybersecurity training for employees.

What is social engineering

The US NIST defines social engineering as deceiving a person into revealing confidential information, gaining unauthorised access or committing fraud. The CISA agency adds that the attacker uses social skills to obtain or compromise information about an organisation and its systems. In the context of information security, social engineering is therefore an attack on the least protected element: a person who has access to data, money and the building.

In Polish, two terms are used for this, "socjotechnika" and "inżynieria społeczna", and in practice they mean the same thing. An attack can come by email, text message, phone call or messaging app, but also in person: at the office door, at reception or by the waste paper container.

In 2025 CERT Polska (Poland's national computer emergency response team) recorded 260,783 incidents, of which 253,238, or 97%, were computer fraud. Most often this involved phishing for logins and passwords, which is a classic social engineering attack. In the USA, the FBI recorded 24,768 complaints of BEC fraud (impersonating a CEO or supplier to redirect a payment) in 2025, with losses exceeding USD 3 billion.

62%

of data breaches involved the human element

Verizon, DBIR 2026

97%

of incidents recorded by CERT Polska in 2025 were computer fraud

CERT Polska, Annual Report 2025

USD 3.05bn

in reported losses from BEC fraud in the USA in 2025

FBI IC3, Internet Crime Report 2025

Why social engineering attacks work

Social engineering does not need naive victims. It works because it exploits the mental shortcuts we all use every day to make decisions quickly. In his book "Influence", the psychologist Robert Cialdini described principles that become a weapon in a fraudster's hands:

• Authority: a request "from the CEO", "from the ministry" or "from IT" is less likely to meet resistance. An employee does not want to question an instruction from a superior.
• Scarcity and time pressure: "your account will be blocked in an hour", "the transfer has to go out before 3 pm". Haste switches off careful checking.
• Liking: it is easier to help someone pleasant who knows our name, mentions mutual acquaintances or praises our work.
• Reciprocity: someone who has received something from us, even a small favour, expects something in return. The quid pro quo technique is built on this.
• Social proof: "everyone in your department has already filled this in" makes a request seem normal.
• Commitment and consistency: after agreeing to a small request, it is harder to refuse a bigger one. The conversation starts with an innocent question and ends with a password.

A good attack combines several principles at once: authority, haste and secrecy ("don't tell anyone, this is a board matter"). If you see this combination, you are looking at the strongest warning sign there is.

Social engineering techniques: examples from the workplace

Each technique follows the same structure: what it looks like at work, how to recognise it and what to do.

Phishing and its variants

Phishing is a fake message designed to make you click a link, open an attachment or enter your login details. The variant aimed at a specific person is spear phishing, and the one aimed at senior management is whaling. We describe the types of phishing in detail in our guide to 9 types of phishing, CEO fraud in our article on spear phishing and whaling, and the text message version in our article on smishing.

Warning sign: an unexpected message asking you to log in, pay or open a file, often with a deadline.

What to do: do not click; go to the service yourself (from a bookmark or the app) and report the message.

Pretexting: an invented story

Pretexting means building trust with a made-up scenario: the attacker poses as an auditor, a new employee from head office, a business partner or an official. In the DBIR 2026, Verizon reports that pretexting accounted for 6% of all breaches as an entry method and increasingly opens the way to ransomware and extortion attacks. It most often happens by phone, but also by email and text message.

An example from Poland: at the end of October 2025, CSIRT NASK observed a campaign in which attackers impersonated the Ministry of Digital Affairs and a deputy minister. In one variant they asked municipalities for detailed information about the people responsible for cybersecurity: first names, surnames, phone numbers and email addresses. Such data is then used for attacks on specific people.

Warning sign: someone you do not know asks for information about people, procedures or systems and justifies it with an official or urgent reason.

What to do: do not send data in reply to the message. Check the sender through the institution's official contact details, found yourself, and inform your manager or IT.

Vishing: attacks by phone

Vishing is pretexting by voice: a call "from the bank", "from IT" or "from the CEO". The number on the display can be spoofed. The Ministry of Digital Affairs reminds people that a call can be faked even when the number matches the official one. You can read more about this technique and about verifying callers in our article on vishing, and about voice cloning in our article on deepfakes.

Warning sign: the caller asks for a code, a password, the installation of a remote desktop program or an urgent transfer.

What to do: hang up and call back on a number you know from the contract, the bank's website or the company address book.

Baiting: the lure

Baiting exploits curiosity or the desire for gain. In its physical form it is a USB stick labelled "Bonuses 2026" left in the car park or the kitchen. In its digital form it is a "free" program, template or "payroll" file to download.

Warning sign: something attractive that appeared out of nowhere and needs to be plugged in, downloaded or run.

What to do: do not plug in storage devices of unknown origin; hand them over to IT. Install programs only from sources approved by the company.

Quid pro quo: "something for something"

In the quid pro quo technique, the attacker offers a service in exchange for access or information. The classic scenario: someone calls several people in the company as "technical support" and offers help with a computer problem. Sooner or later they reach a person who really does have a problem and ask them for their login or to install a "diagnostic" tool.

Warning sign: help nobody asked for, combined with a request for login details or remote access.

What to do: use only the official IT support channel. The real IT department does not need your password.

Tailgating and piggybacking

Tailgating means entering a protected area right behind an authorised person, before the door closes. Piggybacking usually means a situation in which an employee knowingly lets a stranger in because they "forgot their card". The attacker helps themselves with their appearance: a technician's high-visibility vest, a courier's parcel, full hands that make you hold the door instinctively.

Warning sign: a person without a visible ID badge who waits by the door and walks in with you.

What to do: politely ask who they have come to see and direct them to reception. If you do not feel confident, report the situation to security or your manager.

Shoulder surfing

Shoulder surfing means looking at someone's screen, keyboard or documents: on a train, in a café, at a conference, but also in an open-plan office. The attacker can see a password, a PIN, customer data or the name of a system, which they later use in pretexting.

Warning sign: someone is standing or sitting where they can see your screen, especially when you are logging in.

What to do: in public places use a privacy filter on your screen, lock your computer every time you step away and do not work on confidential data where someone can watch.

Dumpster diving: searching the rubbish

Dumpster diving means looking for information in discarded documents and equipment. A printout of the staff list, an old invoice, a note with the Wi-Fi password or an organisational chart is ready-made material for an attacker to make their story more convincing on the next call.

Warning sign: documents with company data in an ordinary bin or an unsecured waste paper container.

What to do: shred documents or put them in a locked container, and hand old drives and phones over to IT for secure data erasure.

Cheat sheet: social engineering techniques in one table

How to recognise a social engineering attack: checklist

Before you carry out an unusual request, run through these questions in your head. One "yes" is a reason to stop. Two or more are a reason to report it.

• Did the request arrive unexpectedly or through an unfamiliar channel, for example from the "CEO's" private number?
• Is someone putting you under time pressure or threatening consequences?
• Is the person appealing to authority: the board, a ministry, a bank, the police?
• Is the request an exception to the usual procedure ("this time without the second approval")?
• Is someone asking for confidentiality and for you not to tell anyone?
• Is it about a password, a code, a transfer, a change of bank account number, employee data or remote access?
• Is a page or message telling you to copy a command and paste it into the system "Run" dialog? CERT Polska describes this kind of fake "are you a robot" verification (known as ClickFix), after which malware lands on the computer.
• Does the person know a lot about you but cannot answer a simple verification question?

Remember too that data breaches make social engineering easier. CERT Polska points out that data obtained by criminals can be used to make future social engineering attacks more credible. The fact that a caller knows your name, job title and your boss's surname proves nothing.

Everyday habits that make such attacks harder, such as verifying invoices, MFA and reporting incidents, are collected in our article on 12 rules of cyber hygiene at work. We explain why one stolen password should not open an account in our article on two-step verification.

How to teach your team to recognise social engineering

A lecture on the principles of influence is easy to sit through and just as easy to forget. Resilience to social engineering is built by practising the difficult moments: saying no, ending a conversation, stopping a stranger. You can run the exercises below without any special equipment.

Phone role-play (10 minutes)

One person plays "a bank employee" or "IT" and pushes harder and harder. The other practises a single sentence: "I'll call back on the official number." Then swap roles. The hardest part is actually ending the call, so it is worth repeating.

Spot the principle of influence (15 minutes)

Show five real examples of messages or descriptions of conversations. The team identifies which principle of influence the attacker used: authority, haste, liking or reciprocity. Whoever can name the mechanism will find it easier to notice later.

Office walk-through (20 minutes)

Together with the person responsible for security, walk around the office and check: do the doors close on their own, where do printouts end up, are there documents with data lying on desks, are screens being locked? Write down your findings and come back to them in a quarter.

A verification question for transfers

On the board and in finance, agree on a verification question or a call-back rule for every urgent transfer request. A procedure agreed in advance makes it easier to say no to a "CEO" calling from an unknown number.

Measure reports

After every phishing simulation, show the team how many people reported the message and how quickly. The Verizon DBIR 2026 reports that in simulations the median click rate in phone and text message scenarios was 40% higher than by email, so exercises should not be limited to email.

If your organisation is covered by the amended Polish National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC; Dz.U. 2026 poz. 252), staff education is one of the required measures. We describe the details in our article on NIS2 and KSC training, and you can do an initial check with the test "Is my organisation covered by the KSC?".

How it works in Akademia ZeroLayer

In Akademia ZeroLayer, social engineering is broken down into short video microlessons, games and quizzes devoted to social engineering techniques and warning signs. Phishing simulations test how the team reacts to messages modelled on real campaigns, and role-based paths match the material to the job. New employees cover the basics in an onboarding path, and automatic reminders make sure nobody drops out of the cycle. Social engineering tests with vishing and voice deepfakes are available in the "Academy + Tests" plan, and video deepfakes are covered in a separate workshop. The manager dashboard shows team progress and generates training reports, and every participant receives a numbered certificate. You will find the list of topics in the training topics section, and the available plans, including a free 30-day pilot for one department, in the Options section.

FAQ

What is social engineering in simple terms?

Social engineering means deceiving people, not computers. The attacker poses as someone trusted, such as a boss, a bank or the IT department, and exploits haste, authority or the wish to help so that the employee hands over data, lets them into the building or makes a transfer.

How does social engineering differ from phishing?

Social engineering is a broad term covering all methods of manipulating people. Phishing is one social engineering technique, usually carried out by email or text message. Social engineering also includes phone attacks, pretexting, baiting and physical methods such as tailgating or searching through rubbish.

What are the most common social engineering techniques?

The most common social engineering techniques in companies are phishing, pretexting (an invented story, such as "an inspection from the ministry"), vishing (a call "from the bank" or "from the CEO"), baiting (a lure, such as a USB stick), quid pro quo (help in exchange for access), tailgating and piggybacking (following an employee inside), shoulder surfing (looking at someone's screen) and dumpster diving (searching through discarded documents).

How do you recognise a social engineering attack?

The most common signs are unexpected contact, time pressure, an appeal to authority, a request for an exception to procedure, a demand for secrecy and a request for a password, code, transfer or remote access. If you see even one of them, stop and check the request through a second channel you know.

What should you do if an employee has been fooled?

Report it to IT or a manager immediately, even without being sure that an attack has taken place. If a password has leaked, change it and check whether the account has MFA switched on. If a transfer has gone out, contact the bank at once. Time matters, and quickly reporting your own mistake often limits the damage.

Sources

• Annual report on the activities of CERT Polska in 2025 (Raport roczny z działalności CERT Polska w 2025 roku) — CERT Polska / NASK, 8 April 2026 (in Polish)
• 2026 Data Breach Investigations Report: Executive Summary — Verizon Business, 2026
• 2025 IC3 Annual Report — FBI Internet Crime Complaint Center, 2026
• Social engineering (glossary) — NIST Computer Security Resource Center
• Avoiding Social Engineering and Phishing Attacks — CISA, 1 February 2021
• What spoofing is, how to recognise it and avoid being fooled (Czym jest spoofing, jak go rozpoznać i nie dać się nabrać) — Ministry of Digital Affairs, gov.pl, 4 August 2022 (in Polish)
• Principles of Persuasion — Influence at Work (Robert Cialdini)
• Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts (Ustawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw, Dz.U. 2026 poz. 252) — Journal of Laws of the Republic of Poland (Dziennik Ustaw), 2 March 2026 (in Polish)