Social engineering: techniques and prevention

In short: Social engineering means manipulating people rather than technology to obtain access, confidential information or a payment. The fraudster exploits well-known biases (authority, urgency, trust) through phishing, vishing, CEO fraud or, increasingly, voice and video deepfakes. No antivirus can block a human decision made under pressure. The best protection combines two levers: raising staff awareness and applying objective controls, in particular identity verification and payee/account ownership checks at onboarding and on payments. Meelo automates these controls and makes every decision documented and auditable.

‍

What is social engineering?

‍

Social engineering covers all the manipulation techniques used to push a person into acting against their own interest or that of their organisation: disclosing a password, clicking a booby-trapped link, approving a payment or changing bank details. Unlike a classic cyberattack that hunts for a software flaw, social engineering targets the human flaw. It is often the shortest path: it is easier to convince an employee to hand over a credential than to break into a protected system.

‍

This approach is not new, but it has industrialised. Fraudsters first gather public information (org charts, social media, press releases) to make their scenario credible. The better documented the pretext, the more the victim lowers their guard. Social engineering is today the starting point for the vast majority of frauds and scams targeting businesses.

‍

The main techniques

‍

Phishing. This is the most widespread technique: a fraudulent email imitates a legitimate sender (bank, government body, supplier, internal service) to prompt the recipient to click a link or enter credentials on a fake page. It is sent in bulk with little personalisation.

‍

Spear phishing. A targeted version of phishing, it aims at a specific person with a tailored message. The fraudster names a director, an ongoing project or a genuine invoice. The personalisation makes it far harder to spot.

‍

Vishing and smishing. Vishing relies on a phone call (a fake bank adviser, a fake IT support agent) to extract information or get an operation approved. Smishing uses SMS, often with a parcel-tracking link or a bogus security alert.

‍

CEO fraud and payment fraud. The fraudster impersonates a senior executive or a supplier to order an urgent, confidential payment, or to have bank details changed on a supplier account. This scenario, also known as invoice fraud or Business Email Compromise (BEC), produces the heaviest losses per incident.

‍

Pretexting. The fraudster invents a credible pretext (an audit, a security check, a file update) and takes on a role to gradually obtain information. The scenario is built to look legitimate and routine.

‍

Baiting. This relies on a lure: an abandoned USB stick, free software, an enticing offer. The victim's curiosity or interest triggers the installation of malicious software.

‍

Voice and video deepfakes. Using artificial intelligence, a fraudster can clone an executive's voice or generate a faked video call. An employee receives a call or joins a video meeting where they believe they recognise the people involved, and approves a payment. This technique takes CEO fraud to a new level of credibility.

‍

Why it works: human biases

‍

Social engineering does not rely on the naivety of its victims but on universal psychological triggers that the fraudster deliberately activates.

‍

The first is authority: faced with a request from a director, a regulator or an official body, the instinct is to comply without question. The second is urgency: by imposing a very short deadline ("the payment has to go out before noon"), the fraudster prevents any checking and short-circuits reflection. The third is trust: a message that uses the right tone, the right names and the right context disarms suspicion.

‍

Add to this fear (the threat of a penalty or a blocked account), greed and the desire to be helpful. These levers are all the more effective when applied to people who are busy, constantly solicited and used to handling requests quickly. Emotional pressure is the real engine of social engineering.

‍

Social engineering, payment fraud and onboarding

‍

Two moments are particularly exposed: the start of a business relationship and the execution of payments.

‍

At onboarding, a fraudster can pose as a legitimate customer or supplier using falsified documents and a stolen identity. Social engineering is used here to get past the human vigilance of the person handling the file: a reassuring pitch, a fake supporting document and a bit of deadline pressure are sometimes enough to get a file accepted that never should have been. This is the entry point for many document frauds and identity thefts.

‍

On payments, social engineering takes the form of a request to change bank details or an urgent payment order. The target account belongs to the fraudster, but nothing in the message gives it away. Once the payment has been executed, the funds are rarely recoverable.

‍

In both cases the link being exploited is human, but the most reliable safeguard is objective: verifying that the identity is real and that the account belongs to the declared person or entity. An automated control cannot be impressed by authority or rushed by urgency.

‍

How to protect against it

‍

Effective protection combines an organisational dimension with technical controls.

‍

Raise staff awareness. The first line of defence remains employee vigilance. Teams should be trained to recognise warning signs (abnormal urgency, requests for secrecy, changes to bank details) and a culture should be established where questioning and checking are never held against anyone. The NCSC (National Cyber Security Centre) recommends regular awareness campaigns and simulation exercises.

‍

Introduce dual validation. No sensitive request (an exceptional payment, a change of bank details, access to data) should be executable by a single person on the basis of a simple email. A separate verification channel, such as a callback to a known number, breaks the fraudster's scenario.

‍

Verify identity and account details automatically. This is the lever that neutralises social engineering at its root. Identity verification (checking the document, detecting tampering, matching it to the person) confirms that the counterparty is who they claim to be. Payee/account ownership verification confirms that the beneficiary account belongs to the correct holder, at onboarding and at every change. These checks must be systematic and not left to the judgement of the moment.

‍

This is precisely what Meelo automates: identity, documents and account details are verified in a single journey, with a fraud score and identity verification that produce a decision in 2 to 5 seconds, documented and auditable. For a broader view of the checks involved, see our complete KYC guide.

‍

In conclusion

‍

Social engineering remains the preferred entry point for fraud because it targets the hardest link to secure: people. Phishing, CEO fraud, deepfakes, the techniques evolve, but the principle stays the same: manipulate to obtain access, information or a payment. Awareness is essential, but it is not enough against increasingly credible scenarios. By adding objective, automated identity and account checks at onboarding and on payments, an organisation stops relying solely on human judgement under pressure. It is the combination of vigilance and automation that shuts down fraud.

‍

FAQ

‍

What is social engineering in cybersecurity?

‍

In cybersecurity, social engineering refers to the psychological manipulation techniques used to push a person into disclosing confidential information, granting access or carrying out an action (a payment, a click on a booby-trapped link). It exploits the human flaw rather than a technical one, which makes it dangerous even in environments that are technically well protected.

‍

What is the difference between phishing and social engineering?

‍

Phishing is one technique among several; social engineering is the broad category that contains it. In other words, all phishing is social engineering, but social engineering is not limited to phishing: it also includes vishing, pretexting, baiting, CEO fraud and deepfakes. The common thread is the manipulation of the victim.

‍

How can businesses protect against social engineering?

‍

Protection rests on three pillars. First, raise awareness and train teams to spot suspicious requests. Second, enforce dual validation on any sensitive operation, through an independent verification channel. Third, automate objective controls: identity verification, document fraud detection and payee/account ownership verification at onboarding and on payments.

‍

Are deepfakes a form of social engineering?

‍

Yes. A voice or video deepfake is a tool serving a manipulation scenario: it is used to reinforce the credibility of a fraudulent request, typically CEO fraud via a faked video call. The deepfake hacks no system; it deceives the human. On that basis it is an advanced and particularly convincing form of social engineering.

‍

Sources

‍

• NCSC (National Cyber Security Centre), guidance and awareness campaigns on phishing and social engineering.
• UK Finance, framework and figures on authorised push payment (APP) fraud and payment fraud.
• Confirmation of Payee (CoP) framework applicable to payments.