Social Engineering

Attackers reach their targets through email, text messages, phone calls, collaboration tools, and social media, sometimes with QR codes or counterfeit websites. They often gather publicly available information, including from social media, to tailor messages and make them more credible, and they use emotions such as fear, trust, or urgency to push the target to act quickly.

Common forms include phishing and its variants, such as spear phishing, whaling, smishing, and vishing, and business email compromise, in which attackers impersonate executives or trusted third parties to get victims to transfer funds. Social engineering is also combined with technical exploitation: a phishing email can carry a link or attachment that activates an exploit and gives the attacker access to the victim's system. Artificial intelligence makes these attacks more effective through realistic phishing messages, personalized lures, and deepfake impersonation.

Anyone can be targeted. Attackers often focus on people with access to valuable information, accounts, systems, or money, or who can approve payments or access requests, such as senior managers, IT staff and system administrators, and finance, human resources, and legal teams.

The Canadian Centre for Cyber Security recommends regular staff training, confirming unusual requests through a separate, verified channel, applying least privilege, limiting what staff share on social media, phishing-resistant multifactor authentication, and an incident response plan that covers social engineering. ASD advises treating any request to change system settings, run code, or alter security settings as highly suspicious and verifying it independently.