Social engineering gains a target’s trust and persuades them to reveal confidential information or take an unsafe action. Rather than exploiting software alone, an attacker exploits human trust through in-person contact, phone calls, email, messaging apps, or social media. section 1.1
A familiar form is phishing: a message designed to trick someone into sharing a password. Spear phishing is more targeted; attackers research named people, often in accounting, before tailoring the fraud. section 1.1
Targeted payment fraud
An attacker researches an accounting employee and sends a convincing message that asks for credentials. The targeted detail makes the request appear more trustworthy, illustrating why spear phishing can be effective. section 1.1
Social engineering also overlaps with insider risk. Rogue employees or contractors may leak or sell secrets; restricting sensitive data to people with a need to know limits what a bad actor can access. section 1.1
