13 Types of Social Engineering Attacks and How to Test Your Defences

The main types of social engineering attacks are phishing, spear phishing, whaling, business email compromise, vishing, smishing, MFA fatigue, pretexting, baiting, quid pro quo, tailgating, deepfake impersonation and watering hole attacks. All of them manipulate people rather than technology. They exploit helpfulness, trust, respect for authority and urgency to get money, credentials or access. A social engineering assessment tests how your people and processes respond to each route, under controlled and authorised conditions.

This guide explains each type of attack with examples, why they work, the controls that stop them and how a social engineering assessment tests your defences.

Key takeaways

• Social engineering targets people and processes, so technical controls alone can’t remove the risk.
• Most attacks combine a delivery route (email, phone, message, in person) with a believable pretext.
• Process controls, such as call-back verification and helpdesk identity checks, stop more attacks than warnings do.
• A social engineering assessment tests the routes an attacker would actually use against you.
• PCI DSS and ISO 27001 both expect staff awareness of social engineering; testing shows whether it works.

What is a social engineering attack?

A social engineering attack is an attempt to trick a person into helping an attacker: revealing information, making a payment, resetting a password, approving a sign-in or opening a door. Instead of breaking through technical controls, the attacker manipulates trust, authority, urgency or helpfulness so that someone with legitimate access does the work for them.

In cyber security, social engineering is the umbrella term for these techniques. It works because it goes around security controls rather than through them. A strong firewall doesn’t help if someone on the helpdesk resets the finance director’s MFA for a convincing caller.

Most attacks follow the same three steps:

1. Research. The attacker learns names, roles, suppliers and processes from websites, social media, job adverts and public filings.
2. Pretext. They build a believable story, such as a supplier with new bank details, IT support fixing a fault or a director who needs a favour.
3. Delivery and pressure. They make contact by email, phone, message or in person, and add urgency or authority so the target acts before checking.

What are the main types of social engineering attacks?

There is no official list, but these 13 types cover the routes attackers use most. Each one pairs a delivery channel with a believable story.

What do these attacks look like? 13 social engineering examples

Each type below has a short definition and a realistic example of how it is used.

1. Phishing

Phishing is a mass message that pushes the reader to click a link, open an attachment or sign in to a fake page. Wording is now fluent and targeted, so spelling mistakes are no longer a reliable sign. Example: a fake shared-document notification that leads to a copy of the Microsoft 365 sign-in page, or a QR code that moves the victim from a protected laptop to a personal phone. Our guide to phishing simulation examples shows how each variant can be tested safely.

2. Spear phishing

Spear phishing is phishing researched and aimed at a specific person or team, using names, projects and suppliers found online. Example: an email to a payroll officer that mentions a real colleague and asks them to review an “updated salary file”.

3. Whaling

Whaling is spear phishing aimed at senior executives, whose authority makes a successful attack more valuable. Example: a message to a finance director, apparently from the company’s lawyers, about a confidential acquisition that needs an urgent transfer.

4. Business email compromise

In business email compromise, an attacker uses a compromised or spoofed mailbox to ask for a payment or data, often inside a real email thread. Example: a supplier’s genuine but hacked mailbox sends an invoice with “new” bank details.

5. Vishing

Vishing is voice phishing: phone calls posing as IT, a bank or a supplier. A live conversation creates pressure, and the helpdesk is a favourite target because it can reset passwords and re-register MFA. Example: a caller claiming to be a travelling director who has lost their phone and needs MFA moved to a new number.

6. Smishing

Smishing is phishing by text message or messaging app, relying on familiarity and a small screen that hides the real link. Example: a text about a missed parcel with a link to a payment page, or a WhatsApp message that seems to come from a colleague.

7. MFA fatigue

MFA fatigue means sending repeated sign-in prompts to someone whose password the attacker already has, until they approve one to make it stop. Example: a burst of push notifications late at night, followed by a call from “IT” asking the user to accept the next one.

8. Pretexting

Pretexting is the invented story that gives the attacker a reason to ask for something, used by email, phone or in person. Example: a “new contractor” calls the service desk on their first day asking for a password reset because they cannot get into their account.

9. Baiting

Baiting leaves something tempting for people to try, such as an infected USB drive or a “free” download. Example: USB sticks labelled “Salary review” left in a car park or reception.

10. Quid pro quo

Quid pro quo is an offer of help in exchange for access or information. Example: a caller posing as IT support offers to fix a slow laptop and asks the user to install a remote access tool.

11. Tailgating

Tailgating means following someone with legitimate access through a secure door, often while carrying boxes or claiming a forgotten pass. Example: a “courier” follows staff through a side entrance and finds an unlocked workstation. In-person attacks are often overlooked because they feel old-fashioned, yet one unlocked workstation can undo a lot of technical security.

12. Deepfake impersonation

Deepfake impersonation uses an AI-cloned voice or video of a known person. Example: a voice message apparently from the chief executive asks a finance assistant to make an urgent, confidential payment.

13. Watering hole

In a watering hole attack, rather than contacting victims, the attacker compromises a website they already trust, such as an industry forum or supplier portal, and uses it to deliver malware. Example: a trade association’s site is altered to offer visitors a fake browser update.

Why do social engineering attacks work?

They exploit ordinary, positive traits:

• Authority: people comply with requests that seem to come from senior staff, IT or an auditor.
• Urgency: a deadline stops people checking.
• Helpfulness: staff, especially on helpdesks and receptions, want to solve problems.
• Familiarity: a known supplier’s name or a colleague’s writing style lowers suspicion.
• Reciprocity: an offer of help makes a request feel fair.

That is why training alone rarely solves the problem. The fix is usually a process that makes the safe action the easy one.

How do you defend against social engineering?

• Call-back verification for any change to bank details, using contact details already on file.
• Identity checks at the helpdesk before any password or MFA reset.
• Phishing-resistant MFA where you can, and number matching where you can’t.
• Visitor management that makes challenging strangers normal.
• One simple reporting route with fast feedback to the person who reported.
• Targeted training based on the scenarios that work in your organisation. Our guide to cyber security awareness training explains how to make it stick. For staff, our guide on how to spot phishing emails is a ready-made checklist.

The NCSC’s phishing guidance sets out a layered approach that combines these technical and people measures.

What is a social engineering assessment?

A social engineering assessment is an authorised simulation of these techniques against your organisation. It measures how your people, and the processes that support them, respond under realistic pressure. It differs from a routine phishing simulation, which is usually a frequent training tool across the whole organisation. An assessment is a targeted, multi-channel test of specific teams, processes or sites, designed to find the gaps an attacker would use. If you want regular, organisation-wide campaigns rather than a targeted test, see our phishing simulation service.

In-person scenarios, such as tailgating or posing as a contractor at reception, overlap with physical penetration testing. Our guide to it covers what is tested and how authorisation, landlords and third-party premises are handled.

How is a social engineering assessment run?

1. Objectives and scope. Agree what you want to learn, which teams, sites and channels are in scope, and what counts as success.
2. Authorisation. A senior sponsor gives written authority. HR and legal review the plan, particularly for physical scenarios.
3. Reconnaissance. Testers gather open-source information: your website, social media, job adverts and Companies House filings. What an attacker can learn without inside access is a finding in itself.
4. Scenario design. Testers propose pretexts and you approve them. Realistic, but not cruel.
5. Execution. Testing runs in agreed windows, with a named contact and an immediate stop procedure.
6. Reporting and debrief. The report sets out what was tried, what worked, why, and what to change.

Good assessments avoid distressing pretexts (bereavement, health scares, redundancies), collect only the data the test needs, report by team or process rather than by name, and tell staff afterwards that an authorised test took place.

What do PCI DSS and ISO 27001 expect?

• PCI DSS v4.0.1 requires awareness training that covers phishing and social engineering (12.6.3.1) and technical mechanisms to detect and protect against phishing (5.4.1). Both became mandatory on 31 March 2025.
• ISO/IEC 27001:2022 includes awareness, education and training (Annex A 6.3) and physical entry controls (Annex A 7.2).

Neither requires a social engineering test by name, but an assessment is strong evidence that your controls and training work.

Why Sovereign Secure?

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company and ISO 27001 certified, so we test people and processes with the same requirements your auditors check in mind. We are UK-based, with offices in the US, Singapore, Dubai and Bangladesh, and can discuss testing at sites outside the UK, subject to local law.

Next step

Our social engineering penetration testing covers phishing, vishing and, where in scope, physical scenarios, planned around your objectives. For a goal-based exercise that combines social engineering with technical attack paths, see our red team testing.