Social engineering techniques are the moves inside a scam. They’re what actually gets someone to hand over money, access, or data. Each explanation is short, with a link to the real cases where it turns up. Counts overlap, because one case often uses a few.
Key takeaways
Reviewed by SEE Team · Last reviewed 20 Oct 2026 · How cases are sourced · Library statistics
6 techniques in this group.
Picture an email from a supplier you’ve paid for years, asking you to use a new bank account. Sometimes their real mailbox has been hijacked. Sometimes it’s a lookalike address. Either way, the money ends up with the attacker.
The boss emails late on a Friday. There’s a deal, it’s confidential, and the transfer has to go today. Except it isn’t the boss. Secrecy plus a deadline is the tell.
A supplier invoice arrives looking exactly like the last twenty. The amount’s right, the logo’s right. Only the bank details have changed, and that’s where the payment goes.
Someone posing as an executive asks payroll for a batch of staff tax forms. It sounds routine. Those forms then get used to file fake tax returns and open accounts in employees’ names.
Phishing written for you, not for everyone. It might mention your manager, a real project, or a supplier you actually use, which is why it’s so easy to believe.
One click, and you’re on a sign-in page that looks exactly like the real one. Type your password and you’ve just handed it over.
5 techniques in this group.
The email says you’ve been billed for antivirus you never ordered, and there’s a number to call. Call it, and the con plays out by phone, where no email filter can follow.
A pop-up screams that your laptop’s infected, or a caller says the same. They want remote access, a fee, or both. Genuine tech companies don’t phone people about viruses.
AI copies a voice from a short audio clip. So the panicked call really does sound like your daughter, or the CFO. If it feels off, hang up and ring them back yourself.
Your phone keeps buzzing with login approval requests you didn’t trigger. Late at night, tired, you tap approve just to make it stop. That’s the whole attack.
Someone talks the help desk into a reset, or just logs in with a stolen password. As far as the system knows, they’re you now, so they can move money or go after the next account.
3 techniques in this group.
A person who doesn’t exist, stitched together from a real ID number and made-up details. It can open accounts, build up credit, even get a job, and for a while nobody real notices.
A dream job offer that asks for your bank details up front. Or a remote candidate who isn’t who they say. Fake recruiting hurts job hunters and employers alike.
It starts as a friendly chat, maybe a wrong-number text. Weeks or months later, there’s a crypto platform that’s doing great. The profits are fake. The losses aren’t.
4 techniques in this group.
Rather than attack a big company head-on, the attacker goes after a smaller vendor that already has access. The vendor’s trust becomes the way in.
A USB stick turns up in the parking lot, labeled “Salaries 2024.” Somebody plugs it in to see. That’s usually all it takes.
Somebody hides instructions in a web page, an email, or a file. The AI assistant reading it can’t tell the difference and does what it’s told, even against its own user.
Attackers use AI tools to write malicious code, or to tweak old code so security tools don’t recognize it. It lowers the bar for people who couldn’t code before.
The attack type is how it reaches you: an email (phishing), a call (vishing), or a text (smishing). The technique is the trick inside it, say, pretending to be the CEO or spamming login prompts. That’s how a single phishing email ends up carrying CEO fraud and invoice fraud together.
Going by the cases here, the most common are business email compromise (BEC), 37 cases; CEO fraud, 11 cases; and synthetic identity, 11 cases. Those counts overlap, because one attack usually mixes a few. Spear phishing and credential harvesting tend to come first, and the payment fraud comes last.
The attack type is the channel: email, phone, a text, or someone turning up in person. The technique is the trick inside it, like impersonating an executive or faking a supplier invoice. One technique can show up in several channels, so the library tags both.
Most real attacks string together two or more. A typical run goes like this: research the target, build a pretext with a spear-phishing email or a call, then ask for a payment, a password reset, or remote access. Each technique page lists the cases where it turned up alongside others.
The controls that stop the most techniques are simple. Check payment and account requests on a channel you pick. Use phishing-resistant MFA, like FIDO2 security keys. Have two people approve any new payee. And make the help desk confirm a caller really is who they say before any reset.
Social Engineering Examples