You combat social engineering by making it hard for one convincing message or call to cause harm. Verify unusual requests through a channel you already trust, require multifactor authentication, make reporting quick and blame-free, and practice the scenarios your staff will actually meet: email, phone and text.
What is social engineering?
CISA describes a social engineering attack as one where an attacker uses human interaction to obtain or compromise information about an organization or its systems. The attacker may seem unassuming and respectable, perhaps claiming to be a new employee, a repair person or a researcher, and may even offer credentials to support the story. By asking questions, they can piece together enough to get in. If one person will not help, they try another in the same organization and cite what the first said, which adds credibility.
That last tactic is worth teaching. Each answer a staff member gives can become the proof the attacker uses on the next person.
What are the main forms?
CISA names three that you will meet often:
- Phishing: email or malicious websites that pose as a trustworthy organization to solicit information. Attackers lean on current events, holidays, health scares and economic worries to make a message feel timely.
- Vishing: voice calls. CISA notes that VoIP makes caller ID easy to spoof, which exploits misplaced trust in phone services.
- Smishing: text messages with links, numbers or addresses that can open a browser, a message or a call with a single tap.
Each form creates urgency and aims at a quick action before the target thinks.
What are the warning signs?
CISA lists common indicators of phishing: a sender address that imitates a legitimate business by altering or omitting a few characters, a generic greeting and a signature with no contact details, links whose displayed text differs from the destination, a different domain such as .net instead of .com, poor spelling and layout, and unsolicited attachments paired with a false sense of urgency.
These help, but treat them as hints, not guarantees. A polished message can have none of them. The stronger defense is a process that does not depend on spotting flaws.
What process beats recognition?
Build rules that hold even when a message looks perfect:
- Verify out of band. CISA advises that if you are unsure whether an email request is legitimate, verify it by contacting the company directly, using contact details from a previous statement, not those in the suspicious message.
- Never reveal internal information. Do not share personal or organizational information, including structure or networks, unless you are certain of the person's authority to have it.
- Use MFA everywhere. CISA lists enforcing multifactor authentication among its steps. Even when a password is handed over, a second factor can stop the login. CISA's ransomware guidance goes further and recommends phishing-resistant MFA.
- Add friction for money and access changes. A payment change or a password reset by phone gets a callback to a known number and a second approver.
- Filter. Email filters, anti-phishing features in mail clients and browsers, and spam filters that block risky attachments reduce what reaches people.
What should people do after a mistake?
CISA's steps if you think you revealed information: report it to the appropriate people in your organization, including network administrators, who can watch for unusual activity. Change any passwords you may have revealed, and change them everywhere you reused them. For financial accounts, contact the institution immediately.
The speed of that report matters more than blame. A person who clicked at 9:05 and reported at 9:10 gives defenders time. A person who is afraid to report gives the attacker days.
What does this look like in practice?
Constructed example. A finance clerk gets a call from someone who says they are from the IT help desk and need her password to fix a mailbox problem. She has heard of such calls in training, hangs up and calls the help desk's published number. The real help desk says no one called. She reports the number, and security alerts others in the department the same morning. Nothing in that sequence depended on her recognizing a flaw. It depended on a habit: hang up, call back on a known number, report.
How to check or apply this
- Write a one page rule for verifying requests: out-of-band callback, second approver for payments and access changes.
- Enable MFA on email, the identity provider and any remote access, with stronger methods for administrators.
- Give staff one easy way to report, such as a button or one address, and thank people who use it.
- Run short exercises with realistic email, phone and text scenarios, and focus on reporting, not on scoring failures.
- Limit what public pages and staff profiles reveal about structure and roles.
- Keep filtering on, and review what gets through each quarter.
- After an incident, share a short anonymized story with the whole company.
Quick check
Is training enough on its own?
No. Training helps, but verification rules, MFA and filtering catch what training misses. Design the process so one fooled person cannot cause major harm.
What should I do if I clicked a phishing link?
Report it right away to your security or IT team, change passwords you may have entered, and tell them what you typed or downloaded. Quick reports limit the damage.
Sources
Last reviewed: 18 October 2026.
