Category: Fraud Typologies

Social Engineering

Also known as: human hacking, psychological manipulation attack

Simply put

Social engineering is the use of psychological manipulation and human interaction to trick people into revealing confidential information, such as a password, or into granting access to systems. Rather than exploiting technical flaws, it targets human behavior and trust. It is often the first step an attacker uses to compromise information about an organization or its computer systems.

Formal definition

Social engineering refers to non-technical attack methods that exploit human behavior—through social interaction, deception, and psychological manipulation—to induce individuals to reveal sensitive information or provide access to systems and networks. Attackers leverage social skills to obtain or compromise information about an organization or its computing environment, targeting the human element rather than technical vulnerabilities. Because it relies on manipulating people rather than breaching controls directly, awareness and verification practices are intended to help reduce, but do not guarantee elimination of, exposure to such attacks.

Why it matters

Social engineering matters because it targets the human element rather than technical controls, which means even organizations with strong encryption, tokenization, and network segmentation can be compromised when an attacker successfully manipulates a person. In payment security contexts, a single employee tricked into revealing credentials or granting access can expose systems that store or process cardholder data, undermining otherwise sound technical safeguards. Because these attacks exploit trust and normal human behavior, they are often the first step in a broader compromise rather than an end in themselves.

For compliance and fraud teams, social engineering is significant because it does not map neatly to a single technical control. Awareness training, verification procedures, and access management practices are intended to help reduce exposure, but they do not guarantee elimination of the risk, since attackers continually adapt their pretexts and targets. The effectiveness of any given defense depends on implementation, staff behavior, and ongoing reinforcement rather than on a one-time control.

It is worth noting that the specific frequency and financial impact of social engineering attacks vary by source, period, and methodology, so precise figures should be treated cautiously and confirmed against the underlying study or reporting. The qualitative point that stands regardless of numbers is that human-targeted attacks remain a persistent vector because they bypass, rather than break, technical defenses.

Who it's relevant to

Security Engineers and IT Administrators

Social engineering can circumvent technical controls by targeting the people who hold credentials or administer systems. Engineers should account for the human element in threat models and support verification workflows for sensitive access and configuration requests, recognizing that no technical control alone addresses manipulation of staff.

Compliance Officers

Because social engineering exploits human behavior rather than technical flaws, it is relevant to awareness training and personnel-related practices. Compliance teams should confirm which specific control requirements and their current wording apply against the current published standard rather than assuming a fixed requirement number, and treat training as a measure that helps reduce exposure without guaranteeing elimination of risk.

Fraud Analysts and Merchant Risk Teams

Social engineering is frequently a precursor to account takeover and other downstream fraud, since attackers may use manipulated staff or customers to obtain credentials or access. Analysts should recognize it as an initial-access technique that can enable later fraud rather than as a discrete fraud type on its own.

General Staff and Frontline Employees

Any employee who can be contacted and asked for information or access is a potential target. Recognizing manipulation attempts and independently verifying requests before acting are the primary behavioral defenses, though they reduce rather than eliminate the likelihood of a successful attack.

Inside Social Engineering

Pretexting

A fabricated scenario or false identity used to gain a target's trust and elicit information or actions, such as an attacker impersonating a help desk agent, auditor, or vendor to obtain access to systems or cardholder data.

Phishing

Deceptive electronic communications, typically email, that appear legitimate and attempt to trick recipients into disclosing credentials, sensitive authentication data, or cardholder data, or into clicking malicious links or attachments. Variants include spear phishing (targeted) and smishing (SMS-based).

Vishing

Voice-based social engineering conducted over telephone or VoIP, where an attacker verbally manipulates a target into revealing information or performing actions. This is a common vector in call-center account takeover attempts.

Baiting and quid pro quo

Techniques that offer an apparent benefit or service in exchange for information or access, such as leaving infected media to be found, or offering fake technical assistance in return for credentials.

Impersonation and tailgating

In-person or physical social engineering, including impersonating staff or contractors and following authorized personnel through controlled doors to gain unauthorized physical access to environments where cardholder data may be handled.

Business email compromise (BEC)

A targeted deception, often leveraging compromised or spoofed executive or vendor accounts, intended to induce fraudulent payments or disclosure of sensitive data by exploiting trust and authority rather than technical vulnerabilities.

Human trust exploitation

The underlying mechanism common to all social engineering: manipulation of human psychology, including authority, urgency, familiarity, and fear, to bypass technical and procedural controls rather than defeating them directly.

Common questions

Answers to the questions practitioners most commonly ask about Social Engineering.

Is social engineering just phishing emails?

No. Phishing is one common form of social engineering, but the term covers a broader set of techniques that manipulate people into disclosing information or performing actions. These can include voice-based pretexting (vishing), SMS-based lures (smishing), baiting, tailgating into physical facilities, and impersonation of executives, help desk staff, or trusted vendors. Treating social engineering as synonymous with email phishing tends to leave phone, in-person, and messaging channels under-protected.

Will technical controls like spam filters and firewalls stop social engineering on their own?

No. Social engineering targets human decision-making rather than technical vulnerabilities, so no single technical control eliminates it. Filters, endpoint protection, and network controls may reduce the volume of malicious messages that reach staff and help contain some outcomes, but attackers can still reach targets through phone calls, personal devices, or channels outside the control boundary. Technical controls are intended to work alongside awareness training, verification procedures, and process controls, not to replace them. Any layered approach reduces likelihood; it does not guarantee prevention.

How should staff verify a caller or requester who claims to be an executive, vendor, or help desk?

Use out-of-band verification: confirm the request through a known, independently sourced channel rather than the contact details supplied by the requester. For example, call back on a number from an internal directory or contract of record, not a number provided in the suspicious message. For sensitive actions such as payment changes or credential resets, require a defined approval workflow that does not rely on a single individual's assertion of identity or authority. Document who is authorized to approve which actions so staff can decline requests that fall outside established process.

What controls help protect account credentials and payment operations against social engineering?

Layered controls help reduce risk. Multi-factor authentication can limit the value of credentials obtained through deception, though attackers may attempt real-time relay or MFA-fatigue prompts, so phishing-resistant factors are preferable where feasible. Least-privilege access limits what a compromised or manipulated account can reach. Segregation of duties and dual approval for high-risk actions, such as changing bank account details or resetting privileged access, reduce reliance on any one person being deceived. These measures mitigate but do not eliminate the risk.

How does social engineering relate to protecting cardholder data and PCI DSS obligations?

Social engineering can be a path to unauthorized access to systems and people that handle account data, so it is relevant to any environment within PCI DSS scope. PCI DSS addresses related areas such as security awareness education, access control, and authentication, though the specific requirement wording and numbering differ between versions; confirm details against the current published standard. Reinforce that sensitive authentication data such as full track data, card verification values, and PINs must not be disclosed and must not be retained after authorization, and that staff should never be pressured into reading back or sharing such data on request.

How can an organization test and measure its resilience to social engineering?

Controlled simulations, such as authorized phishing tests and scoped pretexting or physical intrusion exercises conducted under a defined rules-of-engagement agreement, can help assess how staff respond and where processes fail. Results should be treated as indicators for training and process improvement rather than as punitive metrics, since aggressive or poorly scoped testing can erode trust and reporting behavior. Track reporting rates and time-to-report alongside click or disclosure rates, because prompt reporting is itself a protective outcome. Any measured figures depend on the test design, population, and period, and are not comparable across differing methodologies.

Common misconceptions

Social engineering is purely a technical problem that strong encryption, tokenization, or firewalls will solve.

Social engineering targets people and processes, not just technology. Encryption and network controls protect data at rest and in transit but do not prevent an authorized person from being manipulated into disclosing credentials or performing harmful actions. Awareness training, verification procedures, and access controls are needed alongside technical measures, and no single control eliminates the risk.

Anti-phishing filters and security awareness training prevent social engineering attacks.

These controls help reduce the likelihood and impact of attacks but do not guarantee prevention. Detection tools produce false negatives, allowing some crafted messages through, and false positives that may block legitimate communications. Training reduces susceptibility but does not eliminate human error, so layered controls and incident response remain necessary.

PCI DSS compliance by itself means an organization is protected from social engineering.

PCI DSS includes requirements intended to address aspects of security awareness and access management, but the specific requirement numbering and wording differ between versions and should be confirmed against the current published standard. Compliance validation reflects a point in time and defined scope; it is intended to reduce risk but does not by itself guarantee protection against evolving social engineering techniques.

Best practices

Deliver role-based security awareness training that includes recognizing phishing, vishing, pretexting, and BEC, and refresh it periodically; align content with the awareness expectations in the current published PCI DSS version rather than assuming a fixed requirement number.

Establish and enforce out-of-band verification procedures for sensitive requests, such as payment changes, credential resets, and disclosure of cardholder data, so that a single manipulated interaction cannot authorize a high-risk action.

Implement multi-factor authentication for access to systems in and connected to the cardholder data environment, recognizing that MFA raises the difficulty of credential misuse but does not by itself stop all social engineering.

Apply least-privilege access so that a successfully manipulated individual can affect only the minimum data and systems necessary for their role, limiting potential exposure of cardholder data.

Run controlled social engineering testing, such as simulated phishing and, where authorized, physical and voice exercises, and use results to target training and process gaps rather than to penalize individuals.

Maintain and rehearse an incident response process specifically covering suspected social engineering, including reporting channels, credential revocation, and escalation, so that reported attempts are triaged quickly and consistently.