Social Engineering: How Attackers Manipulate People
"Privacy is having control over who knows what about you, and when they get to know it."
— Dr. Tahseen Al-Doori, Cyber Security Essentials, Chapter 8, p. 23
Where you are: Unit III — The Human Attack Surface · Lesson 3.1 · This lesson follows Chapters 1 and 10 of Dr. Al-Doori's Cyber Security Essentials.
Unit III turns from machines to people. Dr. Al-Doori makes the point early in the book: criminals often don't attack your computer at all, they attack you, much as a con artist would. This lesson explains how that manipulation works and gives you one habit that defeats most of it. Every other lesson in this unit builds on it.
What you'll be able to do
Recognize the psychological levers social engineers use and apply the verify-through-another-channel rule.
- Name the four most common pressure levers and spot them in a message or call.
- Explain what pretexting is and why caller ID is not proof of who is calling.
- Verify a request by contacting the person or organisation through a channel you already trust.
What social engineering is
Social engineering means manipulating people into doing something that helps an attacker: revealing a password or code, sending money, opening a file, or changing a setting. It needs no technical skill, just a believable story and a little pressure. The book's example is a caller who claims to be from IT at your school or workplace and simply asks for your password.
It works because it targets normal, decent human instincts. Verizon's 2026 Data Breach Investigations Report found a human element in about 62% of the breaches it studied. People are not the weak link because they are foolish. They are targeted because a convincing story is often cheaper than breaking technology.
The four levers
Almost every scam pulls one or more of these levers. Learn to feel them, because they are designed to stop you thinking.
- Authority. The message claims to come from someone you are inclined to obey: your bank, the police, a tax office, IT support, your manager.
- Urgency. You must act now: "within 10 minutes", "before midnight", "or your account will be closed". Urgency leaves no time to check.
- Fear. Something bad is about to happen: a fine, a locked account, a fraudulent payment, trouble for someone you love.
- Helpfulness. You are asked to do someone a favour: help a stressed colleague, fix a problem for a polite caller, "just confirm" a detail. Most people like to help.
When you notice a lever, treat it as a signal to slow down, not to speed up. Genuine organisations can wait while you check.
Pretexting and caller ID
A pretext is the invented story that makes a request seem reasonable: "I'm from the fraud team and we've seen a suspicious payment", or "I'm the new IT contractor fixing the email migration". Good pretexts use real details: your name, your employer, your manager's name, a recent purchase. Criminals gather these from public posts and earlier data leaks. The UK's NCSC notes that scammers use information people share publicly to make their messages more convincing (you'll audit your own footprint in Lesson 3.5).
Pretexting is increasingly done by phone and text. Verizon's 2026 report found that mobile-centric lures, such as calls and texts, got about 40% higher click rates than email in its simulations.
Phone pretexts often come with caller-ID spoofing: the caller makes your screen display a number or name they choose, such as your bank's name or even your own contact's number. The video in this lesson shows it working. So the name or number on your screen is not proof of who is calling.
The habit: verify through another channel
One rule beats almost every social-engineering attempt:
If a message or call asks you to do something sensitive, stop. Then contact the person or organisation through a channel you already trust, never through the contact details in the message itself.
In practice:
- End the conversation politely. "I'll call you back" is enough. A real bank, employer or colleague will understand.
- Find the contact details yourself. Use the number on the back of your card, the official app, a bookmark, your company directory, or a number you saved long before this contact.
- Call or message on that channel and ask whether the request is real.
- Never share passwords, one-time codes or PINs with anyone who contacts you, however official they sound. The FBI's advice is the same: don't give your account password or PIN to callers, and call the official number yourself.
Never call back the number the caller gives you, and never reply to the same email or text thread. Those channels belong to the scammer. Lessons 3.3 and 3.4 apply this same habit to scam texts, QR codes and cloned voices.
Real-World Example
In 2019, at a hacking conference in Las Vegas, a CNN Business reporter agreed to let security expert Rachel Tobac try to hack him, on camera, with his permission. She started with his public social media posts, which revealed businesses he used and other details. With one phone call to a furniture company, she obtained his current address. Then she called companies he dealt with, using a tool that made her calls display his phone number. Staff trusted the familiar number. During the demonstration she transferred his hotel loyalty points and had his airline seat changed to a middle seat at the back of the plane.
No password was cracked and no computer was broken into. Public details, a believable pretext and a faked caller ID were enough. Her own advice afterwards was that companies must strengthen how they verify callers, and that individuals can make the job harder by sharing less publicly.
From the Book to 2026
What the book teaches. Most attackers are closer to con artists than computer geniuses, and they attack people rather than machines (Chapter 1). A classic trick is a caller posing as IT staff and asking for your password; never log in from an email link, and verify by phone (Chapter 10).
Why it made sense. It was true then and remains true now. Social engineering is still one of the main ways attacks succeed.
What has changed. Security guidance has evolved since the original text. The human element shows up in about 62% of breaches (Verizon 2026), and phone and text lures now out-perform email in simulations. Caller ID can be faked, and AI can now imitate familiar voices (Lesson 3.4). So "verify by phone" must mean a call you place, to a number you already trust.
What to do now. Treat authority, urgency, fear and helpfulness as warning lights, and verify every sensitive request through another channel.
Watch: Watch a CNN reporter get hacked (CNN Business)
This four-minute report shows the Real-World Example as it happened. Seeing a skilled social engineer at work makes the levers far easier to recognise.
As you watch, notice:
- How the attack begins with public posts, and the advice to assume that anything you post publicly can be used to impersonate you.
- The moment the calls show the reporter's own phone number on the company's caller ID, and how readily staff accept it.
- Her closing advice: remove location tags from posts, handle customer-service issues privately rather than in public replies, and her point that companies, not victims, carry the main responsibility.
The report contains a couple of mild exclamations. The video reinforces what you just read — the lesson is complete without it.
What Would You Do?
Your phone rings at work. The caller says he is from IT support, knows your name and your manager's name, and says your account has been sending spam. "I need to confirm your password now, or I'll have to lock your account in 10 minutes and you'll lose access to everything." What do you do?
Knowledge Check
Your phone shows your bank's name. The caller says there is a suspicious payment and asks you to read out the code the bank has just texted you so they can block it. What should you do?
A polite email from a senior manager you have never met asks you to quickly buy gift cards for a client event and send the codes, adding that they are in meetings all day and can't talk. Which response best applies the verify-through-another-channel rule?
Answers explained
- Question 1 — d is right. Hanging up and calling a number you already trust breaks the scammer's control, and one-time codes should never be shared with anyone who contacts you. a is not right: caller ID can be spoofed to show any name. b is not right: the caller may already know your address from public posts or leaks, so their "check" proves nothing. c is not right: any part of a code helps the criminal, and the safe amount to share is none.
- Question 2 — b is right. The directory is a channel you trust, independent of the message. a is not right: replying goes straight back to whoever sent the email, who will happily say yes. c is not right: buying a card first means you have already acted on an unverified request. d is not right: passing it on doesn't verify anything, and the colleague faces the same pressure. Notice the levers: authority (a senior manager), urgency, helpfulness, and "can't talk", which blocks verification.
- The IT call (What Would You Do?): don't give your password, however urgent it sounds. Knowing your manager's name only proves the caller has done some research. Say you'll call back, hang up, and contact IT through the help-desk number or portal you already know. Genuine IT teams don't need you to tell them your password.
Key Takeaways
- Social engineering manipulates people, not machines, and a human element appears in most breaches.
- Authority, urgency, fear and helpfulness are the four levers. Feel one, slow down.
- A pretext uses real details to sound genuine, and caller ID can be faked.
- Verify any sensitive request through a channel you already trust, never the one the request came from.
- Never share passwords, one-time codes or PINs with anyone who contacts you.
Sources
- UK NCSC — Phishing: Spot and report scam emails, texts, websites and calls
- FBI IC3 — Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public (PSA, 2022)
- Verizon — 2026 Data Breach Investigations Report: Executive Summary
- CNN Business — Watch a CNN reporter get hacked
- Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 1: Why Cyber Security; Chapter 10: Common Password Threats