12 Types of Social Engineering Attacks: Can You Spot the Warning Signs?

Imagine receiving an email from your CEO asking you to approve an urgent payment. The message uses the correct company logo, mentions a real project, and sounds exactly like your manager. You approve the transfer—only to discover that the request was fraudulent.

This is how social engineering works. Instead of relying only on technical weaknesses, attackers exploit human trust, emotions, and everyday workplace habits to persuade people to make unsafe decisions.

Social engineering can target anyone, from new employees and customer service representatives to finance teams and senior executives. Understanding the different types of social engineering attacks helps employees recognize suspicious behavior before it leads to stolen credentials, financial loss, or exposed business information.

This guide explains 12 common attack types, shows how they work in real workplace situations, and outlines practical steps your organization can take to reduce risk.

What Are Social Engineering Attacks?

Social engineering attacks use deception or psychological manipulation to influence someone into revealing information, transferring money, granting access, or performing another action that benefits an attacker.

Rather than immediately breaking into a system, a criminal may persuade an employee to provide a password, open a malicious attachment, approve a login request, or share confidential files.

These attacks can happen through email, text messages, phone calls, social media, messaging apps, or face-to-face interactions. Some combine several methods. For example, an attacker might first research an employee online, send a convincing email, and then call to pressure the employee into acting.

The central warning sign is not always a suspicious-looking message. It is often an attempt to make you trust, fear, or obey the sender without checking the request independently.

12 Common Types of Social Engineering Attacks

Social engineering includes several techniques, and the categories can overlap. Phishing, for example, can be targeted at a specific employee, impersonate an executive, or support a business email compromise scam.

1. Phishing

Phishing is one of the best-known types of social engineering attacks. Criminals send deceptive emails or messages that appear to come from legitimate organizations, coworkers, or service providers.

The message may claim that an account will be suspended, a document needs approval, or an invoice is overdue. It encourages the recipient to click a link, open an attachment, enter credentials, or provide sensitive information.

Example: An employee receives an email that appears to come from the company's IT department. It says the employee's mailbox will be disabled unless they sign in immediately. The link leads to a fake login page designed to capture their password.

How to reduce the risk: Check the sender's full address, verify unexpected requests through a trusted channel, and use the organization's reporting process. CISA provides practical advice on recognizing and reporting phishing.

2. Spear Phishing

Spear phishing is a targeted form of phishing. Instead of sending the same message to many people, an attacker customizes the message for a particular employee, team, or organization.

Attackers may use information from company websites, professional profiles, social media, or previous communications to make the message more convincing.

Example: A project manager receives a message that mentions a genuine client meeting and includes a document described as the updated project schedule. The attachment is actually malicious.

How to reduce the risk: Treat unexpected files and links cautiously, even when a message includes familiar names or project details. Confirm unusual requests with the supposed sender using contact information you already trust.

3. Whaling

Whaling is a targeted phishing attack aimed at senior executives or other influential individuals, such as finance leaders, business owners, or department heads.

Because these individuals may authorize payments, access sensitive records, or influence company decisions, attackers may create convincing messages involving legal matters, confidential transactions, or urgent approvals.

Example: A CFO receives an email appearing to come from outside counsel requesting confidential financial documents before a supposedly urgent acquisition.

How to reduce the risk: Establish approval and verification procedures for sensitive disclosures, financial transactions, and unusual executive requests. Seniority should never exempt someone from security checks.

4. Business Email Compromise (BEC)

Business email compromise, or BEC, involves criminals impersonating or gaining access to legitimate business email accounts to deceive organizations into sending money or sharing information. It can overlap with spear phishing and other social engineering methods.

The FBI identifies fake vendor payment changes and fraudulent executive requests as examples of BEC schemes. Messages may use familiar business language and reference genuine transactions to appear authentic.

Example: An accounts payable employee receives an email that appears to come from a regular supplier. It says the supplier has changed banks and asks the employee to send the next payment to a new account.

How to reduce the risk: Verify changes to bank details or payment instructions through a separate, trusted communication channel. Follow documented approval procedures, particularly for wire transfers and other high-value payments. Read the FBI's business email compromise guidance for additional examples and protective measures.

5. Pretexting

Pretexting occurs when an attacker invents a believable story or identity to obtain information or persuade someone to take an action. The attacker might pose as a vendor, auditor, IT employee, recruiter, or government representative.

The story may sound routine, which makes it harder to recognize the manipulation. The attacker may ask seemingly harmless questions first and use the answers to build credibility.

Example: Someone claiming to be a new HR service provider calls an employee to confirm their work email, manager's name, and employee identification number.

How to reduce the risk: Follow your organization's identity-verification process. Do not disclose internal information simply because the person knows company terminology or claims to have an urgent business reason.

6. Vishing and Smishing

Vishing uses voice calls or voicemail messages to manipulate people. Smishing uses text messages. Both commonly imitate trusted organizations or create pressure to respond quickly.

A caller might pretend to be a bank representative, while a text message may claim that a package is delayed or an account has been locked. The goal could be to steal information, collect a verification code, or direct the victim to a fraudulent website.

Example: An employee receives a text claiming that a work account has been compromised. The message provides a link to “secure” the account, but the website collects login credentials.

How to reduce the risk: Avoid using contact details supplied in suspicious messages. Contact the organization through an independently verified number or official website. Never share passwords or multifactor authentication codes with an unsolicited caller.

7. Baiting

Baiting exploits curiosity, convenience, or the promise of a reward. An attacker offers something appealing that encourages the target to download a file, connect a device, or visit a malicious website.

The bait may be digital, such as a free download, or physical, such as a USB drive left where employees are likely to find it.

Example: An employee discovers a USB drive labeled “Confidential Salaries” in a shared office area. Curious about its contents, the employee connects it to a company computer.

How to reduce the risk: Never connect unknown storage devices to workplace equipment. Do not download unauthorized software or files from untrusted sources. Give suspicious physical devices to the appropriate IT or security team.

8. Quid Pro Quo

Quid pro quo attacks promise a service, benefit, or reward in exchange for information or access. The offer can sound helpful rather than threatening.

An attacker may promise technical support, a gift, a discount, or assistance with a workplace problem. The exchange becomes dangerous when the person requests credentials, security codes, or unauthorized access.

Example: A caller claims to be helping employees resolve a system issue. They offer to fix an employee's account if the employee shares a password or approves a login prompt.

How to reduce the risk: Use official support channels and never exchange credentials for assistance. Genuine support staff should follow established identity-verification and access procedures.

9. Tailgating and Piggybacking

Tailgating occurs when an unauthorized person follows an authorized person into a restricted location without proper access. Piggybacking is often used to describe a similar situation in which the authorized person knowingly or unknowingly allows the other person to enter.

Attackers may rely on politeness, a convincing uniform, or the appearance of being in a hurry.

Example: Someone carrying several boxes asks an employee to hold open a secure office door. The employee lets them in without checking their access authorization.

How to reduce the risk: Do not allow unknown people to bypass access controls. Politely direct visitors to reception or the approved check-in process. Report attempts to enter restricted areas without authorization.

10. Scareware

Scareware uses alarming warnings to frighten someone into taking an unsafe action. A pop-up may claim that a computer is infected, files are at risk, or immediate action is required.

The message might urge the user to download a suspicious program, call a fraudulent support number, or pay for a fake service.

Example: An employee browsing the internet sees a full-screen warning that says the computer has been infected. A phone number appears beside instructions to call immediately.

How to reduce the risk: Do not call numbers shown in unexpected security pop-ups or install software they recommend. Close the page if it is safe to do so and follow your organization's process for reporting suspicious activity. Contact IT through an established channel if the warning persists.

11. Watering-Hole Attacks

A watering-hole attack targets a website that members of a particular organization, industry, or professional community commonly visit. The attacker compromises the site or manipulates its content to expose visitors to malicious activity.

Unlike a phishing email, this method may begin when an employee visits a familiar website rather than responding to a direct message.

Example: Employees regularly visit an industry association website for updates. After attackers compromise the site, a page attempts to deliver malicious content to visitors.

How to reduce the risk: Keep browsers and operating systems updated, use approved security protections, and avoid downloading unexpected files from websites. Organizations should use appropriate endpoint protection, web filtering, and monitoring to reduce exposure.

12. Shoulder Surfing and Diversion Theft

Shoulder surfing occurs when someone watches a person enter sensitive information, such as a password, PIN, or access code. Diversion theft uses distraction to create an opportunity to steal property or obtain access.

These methods can happen in offices, public spaces, reception areas, or while employees work remotely.

Example: A person stands close behind an employee using a shared kiosk and watches the employee enter account credentials. In another scenario, a visitor distracts a receptionist while an accomplice attempts to access an unattended workstation.

How to reduce the risk: Shield screens and keypads when entering sensitive information, lock devices when stepping away, and secure confidential documents. Follow visitor procedures and report suspicious attempts to observe or access restricted information.

How to Recognize a Social Engineering Attack

No single warning sign proves that a message or request is fraudulent. However, several common patterns should prompt you to pause and verify before acting.

Watch for mismatched email addresses, unfamiliar domains, unexpected attachments, unusual writing, and requests that fall outside normal procedures. However, polished grammar and familiar branding do not prove a message is genuine. Attackers can copy legitimate content and use information gathered from public sources.

The safest response is to verify the request using a contact method you already trust—not the phone number, link, or reply address supplied in the suspicious message.

How to Prevent Social Engineering Attacks at Work

Organizations need more than a warning poster or a once-a-year reminder. Effective prevention combines employee awareness, clear procedures, and appropriate technical safeguards.

1. Provide practical security awareness training. Teach employees to recognize phishing, impersonation, suspicious payment requests, physical access attempts, and other manipulation tactics. Use realistic examples relevant to their roles.

2. Make reporting easy. Explain how to report suspicious emails, calls, messages, and in-person incidents. Employees should know whom to contact and should not fear blame for reporting a genuine mistake.

3. Verify sensitive requests independently. Require additional checks for payment changes, confidential disclosures, password resets, and unusual access requests. Use a trusted channel separate from the original request.

4. Strengthen account security. Use multifactor authentication, unique passwords, and password managers where appropriate. MFA can reduce the risk of unauthorized access, although it does not eliminate every threat.

5. Maintain physical security. Apply visitor management, badge controls, clean-desk practices, and screen-lock requirements. Remind employees not to let unfamiliar people bypass restricted entrances.

6. Use technical safeguards. Email filtering, endpoint protection, software updates, access controls, and monitoring can help detect or block malicious activity. Technical controls should support—not replace—employee awareness.

7. Review and improve procedures. Use reported incidents and training results to identify recurring weaknesses. Update guidance when attackers change their tactics or the organization introduces new systems and processes.

For broader guidance, the Federal Trade Commission offers practical cybersecurity advice for small businesses.

What Should You Do If You Suspect an Attack?

Act quickly, but follow your organization's incident response procedures. The right response depends on what happened and which systems or information may be affected.

• Stop interacting with the suspicious request. Do not click additional links, open attachments, transfer funds, or provide more information.
• Report the incident promptly. Contact your IT or security team using an approved reporting channel. Preserve the message or relevant details if your procedures allow.
• If you shared credentials, notify IT immediately. Follow instructions to secure the account, change compromised passwords, revoke sessions, or reset authentication methods.
• If you approved a payment, contact your finance team and bank immediately. Fast reporting may help the bank take action on a fraudulent transfer.
• If you opened a suspicious file, tell IT what happened. Do not attempt to investigate or remove suspected malware yourself unless instructed.
• Document the relevant details. Record the approximate time, communication method, requested action, and any steps already taken.

Do not assume that nothing happened simply because you did not see an error message. Prompt reporting helps the organization assess potential exposure, contain the incident, and decide whether further investigation or notifications are necessary. For additional internal guidance, see how to report phishing in Outlook.