Case library
Social engineering examples are real attacks in which criminals manipulate people into giving up access, data, or money, usually by impersonating someone the victim trusts. This library documents 172 of them. Each case names the target, the entry point, what it cost, and the sources.
Each of these is a documented case from the library, with its sources on the case page. They are grouped by the trick that got the attacker in, because that is what a defender can change.
Help desk and IT support
A single call to the IT help desk, impersonating an MGM employee, let Scattered Spider reset MFA, seize identity-system control, and trigger an outage.
Help desk and IT support
Attackers later attributed to Scattered Spider social-engineered Caesars' outsourced IT support.
Help desk and IT support
Attackers phoned Twitter employees posing as the IT help desk, collected VPN credentials, and used internal admin tools to hijack 130 high-profile accounts for a "double your bitcoin" scam.
Help desk and IT support
An attacker used a contractor's stolen password, flooded them with MFA push prompts, then posed as tech support to get one approved.
Executive or supplier
A finance employee in Arup's Hong Kong office joined a video call in which, Hong Kong Police said, every other participant was a deepfake. The employee made 15 transfers.
Executive or supplier
Fraudsters impersonating Ubiquiti's CEO and an outside law firm partner tricked the company's principal financial officer and controller into wiring $46.7M out of its Hong Kong subsidiary's bank account in 14 transfers over two weeks.
Executive or supplier
A Lithuanian fraud ring impersonated a real hardware supplier, Quanta Computer, and used spoofed emails and forged invoices to have both companies pay attacker-controlled accounts.
Phishing email
A phishing email at Target's small HVAC contractor stole credentials for Target's vendor systems, which the attackers reused to reach Target's network.
Phishing email
A spear-phishing email titled "2011 Recruitment Plan," with a booby-trapped Excel attachment, breached RSA and exposed SecurID data.
Phishing email
North Korean operators sent Sony staff fake Apple ID "verify your account" emails, harvested reused credentials, and then detonated wiper malware that crippled the studio.
Text message
A text message and a follow-up call from a fake IT colleague got a Retool employee to hand over one-time codes.
Fake job candidate
KnowBe4 hired a North Korean operative as a software engineer after he passed four video interviews using an AI-enhanced stock photo.
Physical baiting
An infected USB flash drive put into a U.S. military laptop let the agent.btz worm spread to classified networks.
Full case pages are being reviewed and published in stages. Linked names will open the full case.
The ten main types are phishing, vishing, smishing, quishing, pretexting, physical social engineering, deepfakes, help-desk and MFA manipulation, ClickFix and SEO poisoning, and attacks run by AI agents. They are ranked below by how often each appears in real cases. Counts overlap where an attack crossed channels.
A deceptive email that impersonates a trusted sender to steal credentials or trigger a payment.
A phone call in which the attacker impersonates IT, a bank, or an executive and works against your hesitation in real time.
Getting into a building or planting a malicious device, by tailgating an employee or posing as a contractor.
An invented but plausible scenario that gives the attacker a reason to be asking, built before any request is made.
AI systems that research the target, write the lure, and carry the conversation, so one operator can run many tailored attacks.
A cloned voice or face used on a call or video so the victim believes they are dealing with someone they know.
The same deception delivered by text message or a messaging app, where there is no sender address to inspect.
A QR code that carries the malicious link, moving the click onto a personal phone outside corporate filtering.
A poisoned search result or a fake error message that tells the user to paste a command, so the victim installs the malware.
Calling the service desk as a locked-out employee to get MFA reset, which turns account recovery into the way in.
By case count in this library. Counts overlap where one attack used more than one channel.
| Name | What it means | Closest type here |
|---|---|---|
| Spear phishing | Phishing aimed at one person or team, researched in advance | Phishing |
| Whaling | Spear phishing aimed at a senior executive | Phishing |
| Business email compromise (BEC) | Fake executive or supplier emails that redirect payments | Phishing |
| Baiting | Leaving an infected device or tempting download for the victim to use | Physical social engineering |
| Tailgating or piggybacking | Following an employee through a secure door | Physical social engineering |
| Quid pro quo | Offering help, often fake IT support, in exchange for access | Pretexting |
| Honeytrap | A fake romantic or social relationship used to extract money or access | Pretexting |
| Watering hole | Infecting a site the target group visits often | ClickFix and SEO poisoning |
| MFA fatigue | Flooding a user with push prompts until one is approved | Help-desk and MFA manipulation |
68 of the 172 cases happened in 2024 or later. These are the newest documented incidents.
Censys researchers used passive DNS to unravel a live USPS/UPS "package awaiting action" smishing operation, exposing 682 rotating lookalike hostnames behind a WebSocket-based backend that streamed victims' card data in real time and included an operator kill-switch, a concrete technical case of the package-delivery smishing wave USPS itself had flagged as rising in June 2025.
A caller posing as a Standard Bank representative persuaded the 18-year-old account holder to move her R438,900 education trust fund to a "safe" Capitec account, with three transfers completed within 20 minutes.
Sysdig documented JADEPUFFER, the first known ransomware campaign whose entire kill chain was executed end-to-end by an LLM agent.
A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew him into a fabricated Zoom "government meeting" that appeared to feature PM Lawrence Wong and other senior officials, assembled not from generated likenesses but from obscure, genuine YouTube footage of the real officials with substituted speech laid over it.
A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an "imposter scam executed in conjunction with bank fraud," recovering only $336,299 by the following quarter despite same-day bank, FBI, and insurer engagement.
Under Operation Tri-Force Sentinel, Dubai Police raided at least nine pig-butchering scam centers in Dubai and arrested 275 people, with one further arrest by the Royal Thai Police, working with the FBI and the Chinese Ministry of Public Security. Six people were charged in San Diego as alleged managers, workers or recruiters of Ko Thet Company, Sanduo Group and Giant Company; four are in custody abroad and two are fugitives. DOJ did not describe the status of the other 272 people arrested, and raids on scam compounds commonly detain people trafficked into forced labor alongside operators.
An attack usually moves through five stages. Here they are in the 2024 Arup case, with the control that breaks each one.
The attackers collected public video and audio of the company's UK-based CFO and other staff. Hong Kong Police said the material came from YouTube.
A message impersonating the CFO raised a confidential transaction and a reason to keep it secret.
The employee joined a video conference in which, police said, everyone else was a pre-recorded deepfake.
Reassured by the call, the employee made 15 transfers to five Hong Kong bank accounts over about a week.
Splitting HK$200 million across accounts made the money harder to freeze. The fraud surfaced only when the employee checked with headquarters.
Each warning sign below appeared in a real case in this library.
Your account is being drained, move the money now
Keep this transaction confidential
Read me the code we just sent you
New bank account for a known supplier
From email to a call, or from a call to a chat app
"IT support" on a number you have never seen
Attackers do not need a flaw in software. They use ordinary human reactions, and each reaction below drove a real case.
People comply with a CEO or a lawyer. Ubiquiti's finance staff wired $46.7M after emails impersonating the CEO and an outside law firm.
A caller claiming to be Bank of America told a small-business owner a hacker was draining her account. She wired $20,000 to the scammers.
Help desks exist to unblock people. MGM's help desk reset MFA for a caller posing as an employee.
One fake voice is easy to doubt. A room of familiar faces is not. Arup's employee saw several "colleagues" on the call.
After enough push prompts, someone taps approve. That is how the attacker got into Uber through a contractor's account.
Each control breaks a specific stage of the attack. The case beside it shows the kind of attack the control is built for.
| Control | Stage it breaks | Example case |
|---|---|---|
| Verify payment requests on a channel the requester did not choose, using a number you already hold. | Action | Arup (2024) |
| Prove a caller's identity before the help desk resets a password or MFA. | Contact | MGM Resorts (2023) |
| Use phishing-resistant MFA (FIDO2 security keys) instead of codes or push approvals. | Action | Uber (2022) |
| Require two people to approve new payees and changes to bank details. | Cash-out | Ubiquiti (2015) |
| Train staff on phone and text lures, not only email. | Pretext | Retool (2023) |
| Keep supplier logins away from systems that hold customer data. | Action | Target (2013) |
The median disclosed loss, across the 43 cases that state a loss figure. We report a median, not a total. The library mixes single-victim losses, campaign-wide figures, and estimates, and those cannot be added together. Each case page states what its figure measures.
In 2024 a finance employee at Arup in Hong Kong joined a video call with what looked like the company's CFO and colleagues. Hong Kong Police said every other participant was a deepfake. The employee made 15 transfers totaling HK$200 million, about US$25.6 million, before checking with headquarters.
The four most common in this library are phishing (74 cases), vishing (26), physical social engineering (22), and pretexting (22). Phishing uses email, vishing uses phone calls, physical attacks happen in person, and pretexting builds a false story before any request.
Phishing. It appears in 74 of the 172 cases here (43%), more than any other type. Email is still the main channel, but 38 cases in this library involved a phone call or a text message.
Scenarios that recur in this library include a fake IT support call asking for a password or MFA reset, a fake executive or supplier asking for an urgent payment, a text message with a link to a fake login page, and a fake bank calling about fraud on your account.
Hacking exploits a flaw in software. Social engineering exploits a person, so there is no patch for it. That is why a convincing call to the help desk can get an attacker an MFA reset at an organization whose systems are fully up to date.
Every case cites its sources, with primary documents such as court filings, regulator notices, and company disclosures listed first. Each case is labeled as a documented incident, a reported or alleged incident, or research. The methodology page explains the rules.
172 cases, each with the target, the entry point, what it cost, and its sources. Search by company, attack type, or year.
Social Engineering Examples