Social engineering is the practice of manipulating someone into taking an action they wouldn’t take if they understood what was really happening. In cybersecurity, it is the starting point for most breaches, most fraud, and most brand impersonation.
In early 2025, an attacker posing as a trusted open-source contributor contacted a developer at the cryptocurrency exchange Bybit. The communication was patient and professional, building credibility over weeks before requesting access that ultimately led to $1.5 billion in stolen assets, the largest single theft in cryptocurrency history. No software vulnerability was exploited; they simply convinced a person to do something that seemed reasonable at the time.
That is social engineering: getting someone to act by exploiting trust, authority, and urgency. In cybersecurity, the most common way attackers build that trust is by borrowing the identity of someone the target already knows, whether that is a colleague, a bank, a government agency, or a CEO. A phishing email that looks like it came from your bank, a phone call that sounds like your IT help desk, a text message warning you about suspicious activity on your account. All of these work because they feel like something you would expect to receive.
The Verizon 2025 Data Breach Investigations Report found that 60% of data breaches involve the human element, with social engineering as the leading method. It is not a fringe technique. It is how most cyberattacks begin.
The main types of social engineering attacks
Social engineering takes several forms, each using a different channel to reach its target. What they all share is the same core mechanism: someone pretending to be an entity you trust in order to get you to act.
Phishing is the most common form. You receive an email that appears to come from a company or person you recognize, asking you to click a link, download an attachment, or enter your login credentials. The page you land on often looks identical to the real thing. AI has made these emails dramatically harder to spot, with Microsoft reporting that AI-generated phishing emails now achieve a 54% click rate compared to 12% for manually crafted ones.
Vishing, or voice phishing, is the same concept delivered by phone. The caller claims to be from your bank, your company’s IT department, or a government agency, and asks you to verify information or take urgent action. The M&S breach that cost the retailer hundreds of millions in revenue started with a single vishing call to a help desk. According to Mandiant’s M-Trends 2026 report, voice phishing has now overtaken email as the most common way attackers get their initial foothold.
Smishing uses text messages instead of email or phone calls. You might receive a text claiming to be from your bank about a suspicious transaction, or from a delivery service about a package. The FDIC reports that bank impersonation via text has become the most frequently reported scam, with complaint volumes up nearly twentyfold since 2019.
Business email compromise (BEC) targets organizations specifically. An attacker impersonates an executive, a vendor, or a business partner and sends instructions to transfer funds or share sensitive information. These messages are carefully crafted to match the impersonated person’s writing style and authority level. The FBI recorded $3 billion in BEC losses in 2025 alone.
Pretexting is the long game. The attacker creates a fabricated scenario and builds trust over days or weeks before making the request that matters. The Bybit theft is the textbook example: weeks of credibility-building for a single moment of access.
Why social engineering is so effective
You might wonder why, with all the security technology organizations deploy, the most common attack method is simply asking someone to do something. The answer comes down to economics and psychology.
On the economics side, breaking into a well-defended network through a software vulnerability is expensive and difficult. A zero-day exploit can cost hundreds of thousands of dollars to develop and may be patched within days of discovery. A convincing phishing email costs almost nothing, especially with AI tools that generate personalized, grammatically perfect messages in seconds. CrowdStrike’s 2025 Global Threat Report documented a 442% increase in vishing attacks in the second half of 2024, reflecting of attackers choosing the path of least resistance.
On the psychology side, social engineering is designed to bypass your ability to think critically in the moment. The message comes from someone with authority, like your CEO or your bank. It creates urgency (act now or lose access, miss a deadline, face consequences). And it feels familiar, matching the format and tone of messages you actually receive from that sender. These three levers, authority, urgency, and familiarity, suppress the analytical thinking that would otherwise catch the deception. A CCS 2024 study found that even phishing awareness training delivered immediately after someone clicked a simulated attack did not meaningfully reduce future click rates, because the gap is not between knowing and not knowing but between knowing and acting on that knowledge under pressure.
Why every social engineering attack is a brand impersonation attack
Here is the connection that ties this all together: every social engineering attack requires a borrowed identity. The phishing email claims to be from your bank, the vishing call from IT support, the BEC message from your CFO, and the smishing text from a delivery service. In every case, the attacker is impersonating a brand or institution the target has reason to trust.
Social engineering and brand impersonation are not separate problems. They are the same problem seen from two angles. Social engineering describes what happens to the person being targeted. Brand impersonation describes what happens to the identity being borrowed. The most effective defense addresses both at once: detecting and blocking the fraudulent infrastructure (the fake login page, the spoofed customer service site, the cloned voice) before the social engineering message sends its victim there.
Allure Security’s detection data identified more than 326,000 brand impersonation attempts across 6,279 brands in 2025, from banks and e-commerce platforms to airlines and enterprise software companies. Each of those attempts was the infrastructure behind a social engineering campaign, the destination the manipulation was designed to send someone to.
The Bottom Line
Social engineering is the most common way cyberattacks begin, and every form of it depends on impersonating someone the target trusts. The techniques range from phishing emails and vishing calls to elaborate pretexting campaigns that unfold over weeks. What makes social engineering so difficult to defend against is not that people are careless but that the attacks are specifically designed to arrive at moments when careful thinking is hardest. The organizations that protect their people most effectively are the ones that do not rely on those people to catch every impersonation; they detect and block the fraudulent infrastructure before it reaches them.
Key Takeaways
Social engineering is any cyberattack that works by manipulating a person rather than exploiting a software vulnerability. Attackers exploit psychology, using authority, urgency, and familiarity to get targets to take actions they would not take if they understood what was really happening. In most cases, the attacker impersonates a trusted entity such as a bank, an employer, or a government agency. The Verizon 2025 DBIR found that 60% of data breaches involve social engineering.
The most common forms are phishing (fraudulent emails), vishing (fraudulent phone calls), smishing (fraudulent text messages), business email compromise (impersonating executives or vendors to redirect payments), and pretexting (building trust through a fabricated scenario before making the real request).
Social engineering exploits authority, urgency, and familiarity to suppress critical thinking at the moment of the attack. It is also far cheaper than developing technical exploits. AI has made phishing dramatically more convincing, with AI-generated emails achieving a 54% click rate compared to 12% for manually crafted ones.
Every social engineering attack requires a borrowed identity. The phishing email impersonates a bank, the vishing call impersonates IT support, and the BEC message impersonates a CEO. Social engineering is the manipulation; brand impersonation is the mechanism that makes it convincing.
Training helps people recognize common patterns and normalizes reporting suspicious messages. However, research shows that awareness alone does not meaningfully reduce click rates because social engineering is designed to arrive when analytical thinking is suppressed. The most effective defense detects and blocks the fraudulent infrastructure before the social engineering reaches its target.
