Human layer
How social engineering tricks people
Authority, urgency, helpfulness, and curiosity — the levers used to skip your judgement.
It is a conversation, not an exploit
Social engineering manipulates a person into granting access. The attacker may pose as a colleague, a supplier, a new employee, or a police officer. The goal is always the same: get you to move money, share access, or approve something you would normally question.
The levers
Authority (a director needs this now), urgency (before the deadline), helpfulness (I'm new, can you just…), familiarity (a reply inside an existing thread), and curiosity (open this and see). Recognising the lever is often faster than judging the story.
A protocol beats intuition
Decide in advance how unusual requests get verified: a callback on a known number, a second approver for payments, a code word for family emergencies. When the pressure arrives is the worst moment to invent a process.
Invoice redirection
"Hi, this is the new finance lead at our supplier. We've changed banks — please send the outstanding invoice to the new account today, and don't copy the old contact, they've left."
- A plausible business event (new staff, changed bank).
- A request to avoid the usual verification path.
- A deadline attached to a payment.
- Verify by calling the supplier on a number you already have.
Fictional example · harmless · no live link
Check your understanding
3 questionsQuestion 1 of 3