Protect against social engineering fraud by making sensitive actions impossible to complete on a single message or call: verify requests through a separate channel you already trust, require a second approver for money and access changes, and make reporting easy. Attackers rely on urgency, authority and secrecy.
What is social engineering fraud?
It is fraud that persuades a person to do the attacker's work, such as paying an invoice, resetting a password, sharing a code or installing software. The attacker needs no technical flaw, only a believable story. CISA's guidance on avoiding social engineering and phishing attacks describes the common thread: the attacker exploits trust and tries to push you into acting before you think.
The usual channels are email, text messages, phone calls and, increasingly, messaging and collaboration apps. The FBI's Internet Crime Complaint Center at ic3.gov is where victims in the United States can report such incidents.
What do the lures have in common?
Look for the same four ingredients.
- Authority. The message claims to come from an executive, the bank, IT support or a supplier.
- Urgency. A deadline, a penalty or a secret deal.
- A narrow channel. Reply only by this email, do not call anyone.
- An unusual request. New bank details, gift cards, a verification code, remote access.
Any one is normal. Together they are the pattern.
Which control stops it?
Process beats vigilance. A person under pressure will sometimes be fooled, so build steps that a fooled person cannot skip.
Out-of-band verification. Confirm any change in payment details or access by contacting the requester on a phone number or channel already on file, never one supplied in the message. Write this into procedure.
Dual approval. Payments above a threshold, new payees and privileged access grants need two people. The second person must see the original evidence, not only the first approver's summary.
Callback codes for help desks. A help desk should verify identity with something an impersonator would not have, not with facts available from social media. Resets for privileged accounts need a stronger step than a phone call.
Strong authentication. Phishing-resistant sign-in methods lower the value of stolen passwords. A one-time code that a user reads out to a caller is only as strong as the user's resistance to being rushed.
What does an attack look like?
A constructed example: an accounts payable clerk receives an email in a long thread about a real project. The thread looks genuine because an attacker is already reading it from a compromised mailbox. The latest message says the supplier has changed banks and asks that the next payment go to a new account, with an apology for the short notice. The clerk follows procedure, calls the supplier's number from the contract, and the supplier says nothing changed. The payment is held and the mailbox is reset. The control that worked was not detection of a fake email; it was a call that the procedure required.
What should you do after a mistake?
Speed matters. If money moved, contact your bank immediately and ask about recall, then report to law enforcement. If credentials were shared, reset them and revoke active sessions. If software was installed, isolate the device. NIST SP 800-61 Revision 3 describes how to fold incident response into broader risk management, including preparing in advance and learning afterward. A blameless review that asks which step failed will teach more than finding someone to fault.
How to check or apply this
- Write a one-page rule: changes to payment details or access are verified through a known channel, always.
- Set dual approval thresholds for payments and for privileged access.
- Give the help desk a verification script and forbid resets on a call alone for admin accounts.
- Turn on phishing-resistant authentication for finance, executives and administrators first.
- Add a one-click report button and publicize that nobody is punished for reporting.
- Run a short exercise each quarter using a constructed scenario like the one above.
Quick check
Can technology alone block social engineering?
No. Filters help, but the attacker can use a phone call or a real compromised mailbox. Procedures that require verification catch what filters miss.
Where do I report it?
In the United States, the FBI's IC3 accepts complaints at ic3.gov. Elsewhere, use your national cybercrime reporting service, and tell your bank at once if money moved.
Sources
- CISA, Avoiding Social Engineering and Phishing Attacks
- CISA, Recognize and Report Phishing
- FBI Internet Crime Complaint Center
- NIST SP 800-61 Rev. 3, Incident Response Recommendations
Last reviewed: 18 October 2026.
