Social engineering is the manipulation of people into doing something that helps an attacker, such as revealing a password, approving a sign-in, paying an invoice or running a file. It goes after people's judgement instead of a software flaw. That is why it works against well-patched organisations, and why it remains one of the most common ways into a business.
This guide explains how social engineering works, the main types, what AI has changed, and the controls in Microsoft 365 that limit the damage when someone is fooled.
How social engineering works
Almost every social engineering attack has the same four parts:
- Research. The attacker learns who does what: who approves payments, who runs the help desk, which suppliers you use, who has just joined. Company websites, LinkedIn and previous breaches supply most of it.
- A pretext. A believable reason to get in touch. It might be an overdue invoice, a password reset, a job interview, a delivery problem or a message from the chief executive.
- Pressure. Urgency, authority, fear, helpfulness or reward. The aim is to make the target act before they stop to think.
- The ask. One specific action, such as clicking a link, entering a code, changing bank details, approving an MFA prompt or running a file.
The ask is usually small, which is the point. Nobody hands over the whole network, but one approved sign-in or one changed bank detail can be enough.
Common types of social engineering
Phishing
Email that impersonates a trusted sender to get a click, a credential or a file opened. Spear phishing targets a named person with researched detail. Modern phishing often uses real Microsoft sign-in pages, through device code phishing or adversary-in-the-middle proxies, so the page itself looks genuine.
Vishing and help desk impersonation
Voice calls, often posing as IT support or as an employee locked out of their account. The caller's goal is usually an MFA reset or remote access to a laptop. Some groups now combine a flood of spam emails with a Teams call from a fake help desk offering to fix it.
Smishing and messaging apps
Texts and WhatsApp messages about parcels, payments, or a manager "on a new number". These channels sit outside your email filtering.
Business email compromise
Invoice and payment fraud, often sent from a real but compromised supplier mailbox. We cover it in depth in What Is Business Email Compromise?
Pretexting and recruitment lures
An invented scenario built up over several messages, such as a recruiter, an investor or a journalist. Developers in particular are sent "coding tests" that run malware when the project is opened. Microsoft reported in October 2026 that North Korean groups use this approach at scale.
Baiting and physical approaches
USB sticks left in car parks, tailgating through a door, or a "delivery driver" who needs to plug something in. These are rarer than email, but they bypass every network control.
Fake downloads and paste-and-run lures
Search adverts and fake GitHub pages for popular software, or web pages that tell the user to paste a command to "fix" an error. Our explainer on ClickFix covers the second.
What AI has changed
Social engineering is not new, but generative AI has changed three things.
- The tells have gone. Spelling mistakes, awkward phrasing and generic greetings used to give phishing away. AI writes fluent, well-formatted text in any language and tone, so "look for typos" is no longer useful advice.
- Tailoring is cheap. Researching a target and writing a personal lure used to take time, so attackers saved it for high-value people. AI produces dozens of tailored lures in minutes, which brings ordinary staff into range.
- Voices and faces can be faked. Cloned voices and altered video make a phone or video call from the "finance director" or a "job candidate" less reliable as proof of who someone is.
The result is that defences built on spotting the lure get weaker each year. Defences built on making the ask harder to grant hold up much better.
How to defend against social engineering
Make the ask harder to grant
- Phishing-resistant MFA, such as passkeys or Windows Hello for Business, so a stolen password or relayed code cannot be used on an attacker's device.
- Conditional Access that requires a compliant device and blocks risky sign-ins. Our guide to Conditional Access and Identity Protection covers the policies.
- Block device code flow where it is not needed.
- Verification by a second channel for any change of bank details, any payment above a threshold, and any MFA reset. Call back on a number you already hold, never one in the message.
- Help desk identity checks that do not rely on information an attacker can find, such as a manager's approval or an in-person or on-camera check against ID.
Reduce what gets through
- Email protection with Safe Links, Safe Attachments and impersonation protection in Defender for Office 365.
- External tagging for email and for Teams chats from outside the organisation.
- Restrict external Teams access to the domains you work with.
- Attack Surface Reduction rules that stop Office and scripts launching executable content.
Train for behaviour, not trivia
Awareness training still matters, but its aim has changed. Instead of "spot the fake", teach people that urgency is the warning sign, that the right response is to check through another channel, and that reporting a mistake quickly is welcome and never punished. A fast report is often worth more than a perfect click rate.
Detect what still gets through
Some attacks will succeed. The question is how quickly you see the result: a sign-in from a new device after a phishing click, a new inbox rule, an MFA method registered at 2am, or a remote access tool installed after a "help desk" call. These signals sit in Entra, Exchange and Defender, and they need someone watching them around the clock.
How Wizard Cyber helps
Our SOCs are staffed 24/7 and investigate the identity and endpoint signals that follow a successful lure, with senior analyst sign-off by default on the managed service. Every investigation produces a full report, so you can see what happened and what was done. Our consultants can also review your Microsoft 365 configuration against the controls above.
Frequently asked questions
What is the most common type of social engineering?
Email phishing is the type most organisations see most often, with business email compromise and phone-based approaches close behind. The NCSC's phishing guidance is a good starting point for UK organisations.
Is social engineering a cyber attack?
Yes. It is often the first step of a larger attack, such as ransomware, data theft or payment fraud, and it usually leads to activity that technical controls can detect.
Can MFA stop social engineering?
Phishing-resistant MFA stops many credential-theft attacks, because the credential only works on the genuine site and device. It does not stop someone being persuaded to pay a fake invoice or install remote access software, so verification processes are still needed.
How do I spot an AI-generated phishing email?
Often you cannot, because the writing is fluent. Focus on the request instead. Be wary of anything that asks you to act urgently, change payment details, approve a sign-in, enter a code or run something, and check it through a channel you already trust.
What should staff do if they think they have been tricked?
Report it straight away to IT or security, even if nothing seems to have happened. Change the password if one was entered, and tell the bank immediately if money was sent. In the UK, fraud can be reported to Report Fraud.
If you would like help testing how your organisation stands up to these techniques, talk to our team.