Not every attack is technical. Social engineering is the art of persuading a person to do something they should not, by playing on trust, helpfulness, fear, or the natural wish to avoid awkwardness. Phishing is one form of it, but the same tricks work in person, on the phone, and at the front door. The target is not your computer, it is human nature.
Pretexting: a believable story
The attacker invents a reason to contact you, such as being from IT support, a supplier, or head office. A convincing story lowers your guard and makes an unusual request feel routine, which is the whole point.
Tailgating: following you through the door
Someone carrying boxes or a coffee waits by a secure door for a helpful person to hold it open. Once inside, they can reach unattended computers, papers, or network points. Politely checking who someone is protects everyone, and good visitors expect it.
They exploit helpfulness and authority
Most people want to be helpful and do not want to challenge someone who sounds senior or urgent. Social engineers lean on both, using confidence and pressure so that questioning them feels rude or risky.
Small pieces add up
A name overheard here, a schedule learned there, a job title from a website, and suddenly the attacker sounds like an insider. Be a little careful about what your business shares publicly and what staff give away on a casual call.
It is fine to slow down and verify
The best defence is a culture where checking is normal and encouraged, not treated as an insult. Anyone genuine will understand you calling back on a known number or confirming with a colleague before you act.
Red flags to watch for
- A caller who sounds authoritative and pressures you to act before you can check.
- A request that would have you bypass the normal process, just this once.
- Someone you do not recognise trying to follow you through a secure door.
- A story that discourages you from verifying, or asks you to keep it quiet.
- Unusual requests framed as urgent favours from someone senior.
- A stranger asking seemingly harmless questions about staff, schedules, or systems.
Check yourself
0/31.A confident caller says they are from your IT provider, there is a problem with your account, and they need your password to fix it right now. What do you do?
2.You badge through a secure door and a friendly person with an armful of boxes asks you to hold it open. What is the right thing to do?
3.Why do social engineers rely on urgency, authority, and the wish to be helpful?
This is general guidance, not a substitute for advice on your specific setup. Want a hand putting it into practice? Talk to us or see our care plans.