Social Engineering Attacks: Types and Defence

Short answer: Social engineering is the use of deception to trick people into giving away information, money or access, instead of breaking into systems directly. Common types are phishing, vishing, smishing, pretexting, baiting and business email compromise. Pausing, verifying through an official channel and refusing to share codes are the strongest defences.

Technical defences matter, but most successful attacks still start with a person being persuaded to do something. Social engineering security is therefore about habits as much as software. This guide describes the main attack types, shows examples from India, and lists practical defences for homes and offices.

How social engineering works

Attackers study what makes people act quickly: authority (a bank, police or boss), urgency (account blocked today), fear (legal trouble), greed (a prize or easy income) and helpfulness. The request itself usually looks small: click this link, read me the OTP, install this app, pay this invoice. The most reliable protection is slowing down and checking through a channel the attacker does not control.

The main types of attack

Phishing

Fraudulent emails or messages that imitate a trusted sender and push you to a fake login page or a malicious attachment. See our guide to phishing and UPI scam safety.

Vishing (voice phishing)

Phone calls that pretend to be a bank, courier or police officer. See who called me from this number.

Smishing (SMS phishing)

Text messages with a link or a number to call, such as a fake KYC update, delivery fee or electricity bill warning.

Pretexting

An invented scenario to gain trust, for example a caller posing as IT support, a new colleague or a government official who needs "verification" details.

Baiting

Leaving something tempting, such as a USB drive labelled "salary" or a free download, so that a victim runs it. See USB and pen drive safety.

Quid pro quo

Offering something in return for access or information, such as a free "security check" in return for remote access to your PC.

Tailgating

Following an authorised person into a restricted office or building without proper credentials, often by carrying boxes or pretending to be a delivery agent.

Business email compromise (BEC)

An email that appears to come from a director, supplier or vendor and requests an urgent payment or a change to bank details. The sender address may be a near-match or a hijacked mailbox.

Examples from India

• Fake KYC. A text says your bank account will be frozen unless you update KYC through a link. The link opens a copy of a bank page that collects your login and OTP.
• UPI collect request. A buyer on a classifieds site says they will send money, and a "collect" request arrives. Approving it sends money from you. Receiving money never needs a PIN.
• Job and task scams. A messaging-app offer to earn money by liking videos or completing simple tasks starts with small payouts, then asks for a deposit to unlock larger earnings.
• "Digital arrest". Fraudsters claiming to be officials say you are being investigated and demand a transfer to prove innocence.
• Fake customer care numbers. A search result or a social post gives a false helpline that asks you to install a remote-access app.
• Request from a boss. A message from a number using the director's photo asks an employee to buy gift vouchers or transfer funds urgently.

Warning signs

Be cautious whenever a message combines urgency, secrecy and a request that bypasses normal procedure. Other signals include a sender address that is slightly off, a link whose destination differs from its text, requests for OTPs or PINs, payment to a personal account, and pressure to stay on the phone.

How to defend yourself at home

1. Verify independently. Hang up and call the official number, or open the official app yourself.
2. Never share OTPs, PINs or passwords with anyone, including people who say they are from your bank.
3. Use two-step verification on email, UPI, social media and messaging apps. Create strong passwords with our password generator.
4. Do not install apps or give remote access because a caller asked.
5. Check websites using the legit-website checklist.
6. Keep your PC updated and scanned. Security software can detect malicious attachments and files that arrive after a successful trick.
7. Talk about scams with family members, especially older relatives.

How to defend an office

• Require a second, independent verification (a call to a known number) before changing bank details or paying an urgent invoice.
• Separate duties so that one person cannot request and approve a payment.
• Give staff short, regular awareness sessions with real examples, and a no-blame way to report suspicious messages quickly.
• Enable multi-factor authentication on email and cloud accounts.
• Use visitor registration and badges, and challenge unfamiliar people politely.
• Keep tested backups. See our office ransomware backup checklist and small business security guide.

What to do if you were tricked

Act fast and do not feel embarrassed. Call your bank on its official number, call 1930, report on cybercrime.gov.in, change affected passwords from a clean device, and scan your PC. For an office, inform your IT provider and management immediately and preserve the emails or messages.

Frequently asked questions

What is social engineering in cyber security?

Social engineering is the manipulation of people, instead of technology, to obtain information, money or access. Attackers pretend to be trusted sources and use urgency or fear so that victims act without checking.

What are the main types of social engineering attacks?

The main types are phishing, vishing, smishing, pretexting, baiting, quid pro quo, tailgating and business email compromise. Each uses a different channel but relies on the same idea of tricking a person.

What is the difference between phishing and vishing?

Phishing normally uses email or messages with links and attachments, while vishing uses phone calls. Both impersonate trusted organisations and try to obtain passwords, OTPs or payments.

How can I protect my business from business email compromise?

Verify payment requests and bank-detail changes by calling a known number, require two approvers for transfers, use multi-factor authentication on email, and train staff to report suspicious messages.

Can antivirus stop social engineering?

Antivirus cannot stop someone from believing a lie, but it can detect and quarantine malicious files that follow a successful trick. Human checks and security software work together.

Protect your Windows PC

Scan your PC on demand with PremiumAV Total Security: Quick, Full and custom scans, USB drive scans, real-time file monitoring and a quarantine vault are listed as included on the features page. See pricing or download the installer to try it on your Windows PC.