Social engineering is the use of psychological manipulation to get a person to do something they shouldn't: open a door, hand over information, make a payment or install a file. It doesn't attack systems; it attacks decisions.
Personal security manuals have described it for years: a casual question from a stranger —“do you have a coin?”, “what time is it?”— can be used to distract you while someone else acts. In the digital world, the same script shows up as an unexpected notification or a message demanding an immediate reply.
The six human factors an attacker tries to trigger
| Factor | Physical version | Digital version |
|---|---|---|
| Trust | “I'm new in this department, can you let me in?” | A message from a known contact whose account was compromised. |
| Authority | A fake technician, inspector or courier in uniform. | An email that appears to come from the general manager or a regulator. |
| Urgency | “Quick, I'm late for the meeting.” | “Transfer today or we lose the contract.” |
| Curiosity | A USB drive “forgotten” in the parking lot. | An attachment called “bonus spreadsheet” or “event photos”. |
| Courtesy | Holding the door for someone carrying boxes. | Replying fast so as not to seem rude to a “customer”. |
| Distraction | A conversation that pulls your gaze away. | Many notifications in a row so that one gets approved without being read. |
Three rules that work in both worlds
Break the angle and step back
On the street, the recommendation is to take a step back and look around before engaging with a stranger. In the digital world, the equivalent is to pause: don't reply on the same channel, breathe and check.
Verify through an independent channel
If someone says they're from maintenance, you call maintenance. If the manager asks for a transfer over WhatsApp, you call the number already on record, not the one in the message.
Have the backbone to say no
Courtesy and the desire to help are values, but in security you need to say “I can't do that without verifying.” Organizations must explicitly back whoever says it.
What leadership should do
- Establish in writing that no payment request or change of bank details is approved without independent verification.
- Declare that staff are authorized to ask anyone for identification, including an executive.
- Train with real, local cases, not generic examples.
- Measure reports and response times, and recognize those who report.
Conclusions
Social engineering changes channels but not methods. Training people to recognize the six factors and to respond with a pause, verification and firmness protects both the office door and the company's bank account.
Frequently asked questions
What is social engineering?
It is manipulating people into revealing information, granting access or taking actions that benefit an attacker. It can happen in person, by phone, by email or through messaging apps.
What is tailgating?
It is entering a restricted area behind an authorized person, taking advantage of their courtesy or distraction, without presenting your own credentials.
How is CEO fraud prevented?
With a clear rule: every urgent payment request or account change is verified through an independent channel, using contact details already on record.
Sources
- Internal document “Curso de Seguridad y Comportamiento Preventivo” (in Spanish)
Bring this topic to your organization
The Seguridad 360 Course turns these ideas into habits. Next edition: October 31, 2026 (taught in Spanish).