Social engineering explained: the tactics scammers use and how to verify

What is social engineering? It is the practice of manipulating people, rather than breaking into computers, to get them to hand over information, money or access. ASD describes socially engineered messages as messages sent by malicious actors “in an attempt to direct users into performing specific actions”, such as opening an attachment, revealing a password or transferring money. This guide explains the common tactics (pretexting, baiting, tailgating, and the use of urgency and authority), shows how scams use them, and sets out the warning signs and verification steps official sources describe.

Why it works

Social engineering targets ordinary human habits: wanting to help, respecting authority, reacting quickly to bad news, and being curious about something free. Technical defences such as spam filters and antivirus can’t fully protect against a person who has been persuaded to act.

Scamwatch says scammers rely on three core tactics:

• Impersonation. Pretending to be a bank, government agency, police, a retailer or a friend, using fake websites, lookalike emails or hacked social media accounts.
• Urgency. Pushing people to act fast so they don’t stop to check, with fake deadlines and countdown timers, fake decreasing stock numbers, or threats of account closures.
• Emotion. Using fear (fake virus warnings, threats of immediate arrest or deportation), hope (lottery wins, get-rich-quick schemes), compassion (fake charity appeals) or the need for connection (fake dating site profiles).

ASD adds that workplace messages may appear to come from someone known to the recipient, such as a colleague or senior manager, and may target a specific interest of the person receiving them.

Common social engineering tactics

Pretexting

Pretexting means inventing a believable story (a pretext) to justify a request. The caller might claim to be from IT support “fixing an account problem”, or from a supplier “updating bank details”. ASD notes that attackers exploit a “natural desire to be helpful” by posing as someone with a plausible need for the information. ASD says people “should still consider whether that person has a legitimate need to know that information”, even if the requester is known.

Baiting

Baiting offers something tempting, such as free software, a film, a gift card or a found USB stick, to get someone to download or plug in something harmful. ASD’s malware guidance lists untrusted chargers, cables and USB drives, and apps from third-party sites, online ads or peer-to-peer networks, among the ways malware gets onto devices. See how malware and spyware get onto devices.

Tailgating

Tailgating is the physical version: getting into a secure area by following someone who is allowed in, for example through a door that needs a pass, often while looking like someone who belongs there. It relies on the same politeness and trust as other social engineering. Building access rules are set by each workplace.

Fake support offers

ASD warns about unsolicited offers of help with an account or device. These may pressure people to scan a QR code, share a verification code or install software. ASD’s guidance is to treat any unsolicited offer of “support” with caution. This tactic is common in remote access scams and QR code phishing.

Authority and “CEO fraud”

ASD describes CEO fraud as attackers “masquerading as an organisation’s CEO and requesting large transfers of money”. This overlaps with business email compromise, and newer versions may use AI voice cloning.

How scams use social engineering

Many scams combine several tactics. Phishing, smishing and vishing use impersonation and urgency in emails, texts and calls. Impersonation scams pose as government, banks or police. Investment and romance scams lean on hope and connection over a longer period. Scamwatch says “Mass-market scams target thousands of people at once with the same approach”, while “Relationship scams take a different approach, building trust with one person over weeks or months”.

A fictional example

Sam works in accounts at a small business. On a Friday afternoon he gets an email from “Leah, the managing director”, sent from leah.director@mail.example. She writes that she’s in meetings all day, a supplier is threatening to stop deliveries, and she needs an urgent payment to new bank details. “Please don’t call, I can’t talk. Just get it done before 5.” The email uses authority (the director), urgency (before 5 pm), a pretext (the supplier) and blocks verification (“don’t call”). Sam rings Leah on the number in the staff directory instead. She never sent it.

Warning signs official sources describe

ASD and Scamwatch list signs such as:

• unexpected links or attachments
• requests to change system settings, or to follow unusual step-by-step instructions (ASD says to treat these as “highly suspicious”)
• requests for information the sender wouldn’t normally need, including passwords
• unexpected offers of help with an account or device
• a sense of urgency or pressure to act quickly
• requests to pay by unusual methods such as store gift cards, preloaded debit cards or virtual currency, or to “set up new accounts or PayIDs” (Scamwatch)
• spelling and capitalisation errors, abnormal tone or language, or no named addressee (ASD)
• web addresses that use tricks “such as single letter substitutions” (ASD)
• requests for secrecy, such as “don’t tell anyone” or “don’t call me”, which are designed to stop verification.

How to slow down and verify

Social engineering depends on speed, so the most useful habit is a pause. ASD’s guidance on verifying requests:

1. Don’t use contact details in the message. ASD advises confirming unusual requests or attachments through “a known out-of-band contact method for the sender (e.g. a phone number)”, such as a number from a staff directory or the organisation’s official website.
2. Go to websites directly. ASD says users “should browse to the website themselves rather than clicking on the link in the message”, and to never enter credentials into a website reached from a link in a message.
3. Never share passwords or codes. ASD says: “Users should never disclose credentials such as passwords to other people.”
4. Ask whether the request makes sense. ASD describes considering whether the requester has a legitimate need to know the information.
5. At work, keep the message. ASD says a suspected socially engineered message shouldn’t be deleted or forwarded; instead, contact the organisation’s IT help desk or security team.

Workplaces can build these habits through staff security awareness.

If you’ve already acted on a request

Scamwatch’s guidance on what to do if you’ve been scammed starts with contacting your bank or card provider immediately to report the scam and ask them to stop any transactions. It lists IDCARE (1800 595 160) for free help making a plan to limit the damage, and reporting the scam to Scamwatch. It also lists Lifeline (13 11 14) and Beyond Blue (1300 22 4636) for support.

If a password was shared, see what to do if an account has been hacked. First steps after a scam sets out what to do by situation.

Common questions

What is social engineering?

Social engineering is manipulating people, rather than breaking into computers, to get them to hand over information, money or access. ASD describes socially engineered messages as messages sent “in an attempt to direct users into performing specific actions”, such as opening an attachment, revealing a password or transferring money. Scamwatch says scammers rely on impersonation, urgency and emotion. See why it works.

What are the main types of social engineering?

Common types include phishing and vishing (fake messages and calls), pretexting (a made-up story to justify a request), baiting (a tempting offer that delivers malware), tailgating (following someone into a secure area), fake support offers and CEO fraud. Many scams combine several of these tactics. See common social engineering tactics.

How can I spot social engineering?

ASD and Scamwatch point to unexpected links or attachments, pressure to act quickly, requests for passwords or information the sender wouldn’t normally need, unsolicited offers of support, and requests to pay by unusual methods such as gift cards. A request for secrecy, such as “don’t call me”, is designed to stop verification. See warning signs official sources describe.

How do I check if an urgent request from my boss is real?

ASD describes confirming unusual requests through “a known out-of-band contact method for the sender (e.g. a phone number)”, such as a number from a staff directory, not contact details in the message. ASD describes CEO fraud as attackers “masquerading as an organisation’s CEO and requesting large transfers of money”. At work, ASD says to contact the IT help desk or security team. See how to slow down and verify.

What is pretexting?

Pretexting is inventing a believable story to justify a request, such as posing as IT support “fixing an account problem” or a supplier “updating bank details”. ASD notes attackers exploit people’s “natural desire to be helpful”. It says people “should still consider whether that person has a legitimate need to know that information”, even if the requester is known. See pretexting.

What do I do if I’ve already acted on a scam request?

Scamwatch’s guidance starts with contacting your bank or card provider immediately to report the scam and ask them to stop any transactions. It lists IDCARE (1800 595 160) for free help making a plan to limit the damage, and reporting the scam to Scamwatch. It also lists Lifeline (13 11 14) and Beyond Blue (1300 22 4636) for support. See if you’ve already acted on a request.

Where to get official help

• Scamwatch: report a scam and read current warnings.
• ASD’s ACSC: ReportCyber at cyber.gov.au, and the 24/7 hotline 1300 CYBER1 (1300 292 371).
• IDCARE: 1800 595 160 (individuals), 1800 595 170 (small business).
• At work: the organisation’s IT help desk or security team, as ASD describes.