Social Engineering Attacks: Verify Requests Before Acting

Social engineering works by influencing a person to reveal information, approve access or move money. The message may arrive by email, phone, chat or a familiar vendor account. It often borrows real names and context, so spotting it is less about perfect wording and more about verifying the request.

Notice the pressure pattern

Be cautious when someone demands secrecy, urgency, a password, a one-time code, a gift-card purchase or a change to payment details. A familiar display name does not prove that the sender controls the account. A caller ID can also be misleading.

Verify with a separate route

Use a phone number or contact method already on file, not the one in the new message. For a bank-detail change, confirm it with an established person at the supplier using a previously trusted number. For an MFA prompt you did not initiate, deny it and review the account through its known sign-in page.

Never read a one-time code to someone who called you unexpectedly. Support staff should not need your password. If a request arrives from a compromised colleague's mailbox, replying to that same thread may keep you inside the attacker's channel.

Report early

If you clicked, shared a code or approved a prompt, tell the organization’s security contact quickly. Preserve the message and timestamp. Do not delete evidence or hide the mistake; rapid reporting can limit the impact. Change credentials through the official site and revoke active sessions where appropriate.

Teams can reduce pressure by documenting payment-change checks, providing a clear reporting channel and practicing realistic scenarios. A healthy process makes verification routine, even when the request comes from a senior person or arrives near a deadline.