Case library
Social engineering examples are real attacks where criminals trick people into handing over access, data, or money, usually by pretending to be someone the victim trusts. This library documents 172 of them. Every case names who was targeted, how the attacker got in, what it cost, and where the facts come from.
Every one of these is a documented case, and its sources are on the case page. They’re grouped by the trick that got the attacker in, since that’s the part a defender can actually change.
Help desk and IT support
One phone call to the IT help desk, pretending to be an MGM employee, was enough. Scattered Spider got MFA reset, took over identity systems, and set off an outage.
Help desk and IT support
Attackers, later tied to Scattered Spider, talked their way past Caesars’ outsourced IT support.
Help desk and IT support
Attackers rang Twitter staff pretending to be the IT help desk and collected VPN logins. Then they used internal admin tools to hijack 130 high-profile accounts for a "double your bitcoin" scam.
Help desk and IT support
An attacker had a contractor’s stolen password. They flooded the contractor with MFA push prompts, then posed as tech support to get one approved.
Executive or supplier
A finance worker in Arup’s Hong Kong office joined a video call where, according to Hong Kong Police, everyone else on screen was a deepfake. The employee then made 15 transfers.
Executive or supplier
Fraudsters posing as Ubiquiti’s CEO and a partner at an outside law firm got its principal financial officer and controller to wire $46.7M from the Hong Kong subsidiary’s account, in 14 transfers over two weeks.
Executive or supplier
A Lithuanian fraud ring pretended to be a real hardware supplier, Quanta Computer. With spoofed emails and forged invoices, it got both companies to pay into accounts it controlled.
Phishing email
It started with a phishing email at a small HVAC contractor. That stole the contractor’s login for Target’s vendor systems, and the attackers used it to reach Target’s network.
Phishing email
A spear-phishing email titled "2011 Recruitment Plan," carried a booby-trapped Excel file. It got attackers into RSA and exposed SecurID data.
Phishing email
North Korean operators sent Sony staff fake Apple ID "verify your account" emails and collected reused passwords. Later they set off wiper malware that crippled the studio.
Text message
A text, then a phone call from a fake IT colleague, was all it took for a Retool employee to hand over one-time codes.
Fake job candidate
KnowBe4 hired a North Korean operative as a software engineer. He’d passed four video interviews, using an AI-enhanced stock photo.
Physical baiting
An infected USB flash drive went into a U.S. military laptop, and the agent.btz worm spread from there into classified networks.
10 full case pages are published so far, and the rest follow in stages. Linked names open the full case.
The ten main types are phishing, vishing, smishing, quishing, pretexting, physical social engineering, deepfakes, help-desk and MFA manipulation, ClickFix and SEO poisoning, and attacks run by AI agents. Below, they’re ranked by how often each one turns up in real cases. Some attacks crossed channels, so the counts overlap.
An email that pretends to come from someone you trust, to steal a password or get a payment sent.
A phone call from someone posing as IT, your bank, or the boss, who talks you out of your doubts in real time.
Getting into a building, or planting a bad device, by following an employee through the door or posing as a contractor.
A made-up but believable story that explains why the attacker is asking, set up before any request comes.
AI that researches the target, writes the lure, and keeps the conversation going, so one person can run lots of tailored attacks at once.
A cloned voice or face on a call or video, so you think you’re talking to someone you know.
The same con by text or messaging app, where there’s no sender address to check.
A QR code hiding the bad link, which moves the click onto your own phone, outside company filters.
A rigged search result or fake error message tells you to paste in a command, and you end up installing the malware yourself.
Calling the service desk as a locked-out employee to get MFA reset. Account recovery becomes the way in.
Ranked by how many cases in this library involve each one. Some attacks used more than one channel, so they overlap.
| Name | What it means | Closest type here |
|---|---|---|
| Spear phishing | Phishing written for one person or team, after some homework | Phishing |
| Whaling | Spear phishing that goes after a senior executive | Phishing |
| Business email compromise (BEC) | Fake emails from a boss or supplier that send payments the wrong way | Phishing |
| Baiting | Leaving an infected device, or a tempting download, where the victim will find it | Physical social engineering |
| Tailgating or piggybacking | Slipping through a secure door behind an employee | Physical social engineering |
| Quid pro quo | Offering help, usually fake IT support, in return for access | Pretexting |
| Honeytrap | A fake romance or friendship used to get money or access | Pretexting |
| Watering hole | Infecting a website the target group visits a lot | ClickFix and SEO poisoning |
| MFA fatigue | Bombarding someone with push prompts until they approve one | Help-desk and MFA manipulation |
68 of the 172 cases happened in 2024 or later. Here are the newest ones.
In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today.
A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a hacker was draining her account, so she wired her own money to the scammers.
Most attacks go through five stages. Here’s how they played out in the 2024 Arup case, and what would break each one.
The attackers gathered public video and audio of the company’s UK-based CFO and other staff. Hong Kong Police said it came from YouTube.
A message, supposedly from the CFO, mentioned a confidential deal and a reason to keep it quiet.
The employee joined a video call where, police said, everyone else was a pre-recorded deepfake.
Reassured, the employee made 15 transfers to five Hong Kong bank accounts over roughly a week.
Spreading HK$200 million across several accounts made it harder to freeze. Nobody noticed until the employee checked with headquarters.
Every warning sign below turned up in a real case here.
Your account is being drained, move the money now
Keep this transaction confidential
Read me the code we just sent you
New bank account for a known supplier
From email to a call, or from a call to a chat app
"IT support" on a number you have never seen
Attackers don’t need a software bug. They work on ordinary human reactions, and each one below drove a real case.
People do what the CEO or a lawyer asks. Ubiquiti’s finance staff wired $46.7M after emails that seemed to come from the CEO and an outside law firm.
A caller claiming to be Bank of America told a Chicago hairstylist that a hacker was draining her account. She wired $20,000 to the scammers.
Help desks are there to get people unstuck. MGM’s reset MFA for a caller who was only pretending to be an employee.
One fake voice is easy to doubt. A room of familiar faces is not. Arup's employee saw several "colleagues" on the call.
Send enough push prompts and eventually someone taps approve. That’s how the attacker got into Uber, through a contractor’s account.
Each control breaks one stage of an attack. The case next to it shows the kind of attack it’s built to stop.
| Control | Stage it breaks | Example case |
|---|---|---|
| Check payment requests on a channel the requester didn’t pick, using a number you already have. | Action | Arup (2024) |
| Make the help desk confirm who’s calling before it resets a password or MFA. | Contact | MGM Resorts (2023) |
| Switch to phishing-resistant MFA (FIDO2 security keys) instead of codes or push approvals. | Action | Uber (2022) |
| Have two people sign off on new payees and any change to bank details. | Cash-out | Ubiquiti (2015) |
| Train staff on phone and text lures, not just email. | Pretext | Retool (2023) |
| Keep supplier logins well away from systems that hold customer data. | Action | Target (2013) |
The median disclosed loss, across the 43 cases that state a loss figure. We give a median, not a total. The library mixes losses from single victims, campaign-wide figures, and estimates, and you can’t add those together. Each case page says what its own figure measures.
In 2024, a finance employee at Arup in Hong Kong joined a video call with what looked like the company’s CFO and colleagues. According to Hong Kong Police, every other person on the call was a deepfake. The employee made 15 transfers totaling HK$200 million, about US$25.6 million, before checking with headquarters.
The four most common in this library are phishing (72 cases), vishing (27), physical social engineering (22), and pretexting (22). Phishing uses email, vishing uses phone calls, physical attacks happen in person, and pretexting builds a false story before any request.
Phishing. It appears in 72 of the 172 cases here (42%), more than any other type. Email is still the main channel, but 39 cases in this library involved a phone call or a text message.
Scenarios that recur in this library include a fake IT support call asking for a password or MFA reset, a fake executive or supplier asking for an urgent payment, a text message with a link to a fake login page, and a fake bank calling about fraud on your account.
Hacking exploits a flaw in software. Social engineering exploits a person, so there is no patch for it. That is why a convincing call to the help desk can get an attacker an MFA reset at an organization whose systems are fully up to date.
Every case cites its sources, with primary documents such as court filings, regulator notices, and company disclosures listed first. Each case is labeled as a documented incident, a reported or alleged incident, or research. The methodology page explains the rules.
172 cases, each showing who was hit, how the attacker got in, what it cost, and the sources. Search by company, attack type, or year.
Social Engineering Examples