Why Attackers Target People, Not Just Systems

Modern cybersecurity tools are remarkably effective at blocking automated attacks. Firewalls, antivirus software, and multi-factor authentication have raised the technical bar considerably. So attackers have adapted — increasingly going around technology by going through the people who use it.

This is the core logic of social engineering: humans are often the path of least resistance. We are wired to respond to authority, help others in distress, and act quickly when told something is urgent. Skilled attackers understand these tendencies and design their approaches to trigger them deliberately.

If you're new to thinking about online security, our online safety primer provides grounding in the habits that help most. Social engineering awareness builds naturally on that foundation.

74%

Of breaches involve the human element

According to Verizon's Data Breach Investigations Report, nearly three-quarters of security breaches involve human factors such as social engineering, errors, or misuse.

$2.9B+

Lost to business email compromise annually

The FBI's Internet Crime Complaint Center (IC3) has reported billions in annual losses from business email compromise schemes — a form of targeted social engineering.

60 seconds

Median time to click a phishing link

Research has consistently found that many recipients click phishing links within seconds of receiving them, before deliberate evaluation can occur.

The Most Common Social Engineering Tactics

Social engineering isn't a single technique — it's a family of related approaches, each exploiting a different aspect of human behavior.

  • Phishing: Deceptive emails, texts, or calls that impersonate a trusted entity to steal credentials or install malware. Phishing is more sophisticated than most people expect, designed specifically to disarm skepticism.
  • Pretexting: An attacker fabricates a scenario — often a fake identity — to extract information. A common example is someone claiming to be an IT support technician who needs your login to fix a problem.
  • Baiting: Offering something enticing (a free download, a USB drive left in a parking lot) to lure a target into an action that compromises their security.
  • Tailgating: Physically following an authorized person into a secure area by exploiting politeness — most people hold a door open rather than challenge a stranger.
  • Quid pro quo: Promising a benefit in exchange for information or access, such as fake tech support offers in exchange for remote access to a computer.

The Psychology Behind Why It Works

Understanding why social engineering succeeds is as important as recognizing its forms. Researchers in behavioral psychology have identified several cognitive tendencies that attackers routinely exploit:

  • Authority bias: We defer to people who appear to be in positions of power — a message appearing to come from your bank's fraud department or a government agency carries built-in weight.
  • Urgency and scarcity: Phrases like "your account will be closed in 24 hours" shut down deliberate thinking. When people feel panicked, they act first and verify later.
  • Social proof: Attackers sometimes reference real colleagues, real events, or shared knowledge to seem credible.
  • Reciprocity: We're inclined to help people who appear to be helping us, making fake "support" offers particularly effective.

Some of these same tendencies can quietly show up in everyday digital habits that expand your exposure without any attacker involvement — oversharing on social media, for instance, gives attackers the raw material to personalize their approaches.

“The human mind is not a computer. We don't process information in a linear, logical way — we take shortcuts, respond to context, and trust authority signals. Social engineers know this better than most security professionals do.”

— Bruce Schneier, Security technologist and author on cybersecurity and human behavior

How to Protect Yourself

No single tool eliminates social engineering risk, but a handful of consistent habits make a substantial difference.

Slow down before you act. Urgency is almost always manufactured. Legitimate institutions give you time to verify requests — attackers depend on you not taking it.

Verify identity independently. If someone contacts you claiming to be your bank, hang up and call the number on the back of your card. Never use a phone number or link provided in a suspicious message.

Be skeptical of unsolicited contact. Whether by phone, email, or text, unexpected requests for sensitive information or access deserve scrutiny — regardless of how official they appear.

Limit what you share publicly. Social media profiles, professional directories, and public posts give attackers material to craft convincing, personalized approaches.

Building proactive defenses — from account alerts to knowing how to report fraud — matters too. These digital safety practices are worth establishing before you ever encounter a threat.

Pause Before You Respond

When any message — by email, phone, or text — creates a feeling of urgency or pressure, treat that feeling as a warning sign rather than a cue to act. Giving yourself even 60 seconds to question the request before responding can interrupt the psychological mechanism these attacks rely on. Ask: Did I initiate this contact? Can I verify this through an independent channel?