In July 2020, a seventeen-year-old in Florida called Twitter's internal support line.
He did not introduce himself as an attacker. He introduced himself as a new IT employee, unfamiliar with the systems, needing help with access. Over the course of several calls, using publicly available information about Twitter's tools and internal terminology, he talked his way past multiple employees and into administrative access to some of the platform's most sensitive systems.
Within hours, the accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Apple, and dozens of others had been compromised and used to promote a Bitcoin scam. The attack generated over $100,000 in fraudulent transactions before it was contained.
No sophisticated malware was involved. No zero-day exploit. No technical vulnerability of any complexity. A teenager with a phone, a script, and an understanding of how helpful people tend to be when they believe they are talking to a colleague.
What Social Engineering Is and Why It Works
Social engineering is the practice of manipulating people into taking actions or disclosing information by exploiting psychological tendencies rather than technical vulnerabilities. Where technical attacks target systems, social engineering targets the humans who operate those systems.
It works because the psychological patterns it exploits are not weaknesses. They are features. The inclination to be helpful to a colleague. The tendency to comply with authority figures. The habit of acting quickly when something is marked urgent. These are professionally rewarded behaviours. Social engineering converts them into attack vectors.
This is what makes social engineering so persistently effective despite widespread awareness of it. You cannot patch a human instinct. You can build awareness around it and processes that counteract it. But the instinct itself remains.
The Most Common Forms
Phishing
Phishing remains the most prevalent social engineering technique because it scales. A single malicious email sent to ten thousand addresses requires one compromised recipient to succeed. The email is designed to appear legitimate and prompts the recipient to take an action: click a link, enter credentials, open an attachment.
Spear phishing is the targeted variant. Rather than broadcasting to a large list, the attacker researches a specific individual or organisation and crafts an email personalised with convincing details, the CEO's name, a reference to a current project, a recent company event. The personalisation significantly increases click rates.
Pretexting
Pretexting involves constructing a fabricated scenario, a pretext, that establishes legitimacy and creates a reason for the target to comply. The Twitter attack was a form of pretexting. The attacker played a role that made the request seem legitimate to the people receiving it.
Pretexting attacks often involve significant preparation. The attacker researches the organisation's structure, terminology, and systems well enough to answer follow-up questions credibly. The attack succeeds because of social sophistication, not technical.
Business Email Compromise
Business email compromise caused over $2.9 billion in losses in the United States in 2023, according to FBI data. The attack typically involves either a compromised email account or a convincing look-alike domain, combined with a plausible business request, a change to payment details, a transfer of funds, framed in the normal language of the business relationship.
Why Awareness Training Alone Is Not Enough
Most organisations now run some form of phishing simulation and security awareness training. This is valuable. It is not sufficient.
Awareness training builds knowledge of attack patterns. It does not reliably build the habits and processes that counteract them in real-time conditions. The gap between knowing that phishing exists and pausing to verify an urgent-looking email in the middle of a busy afternoon is substantial.
What closes that gap is not more information. It is friction, deliberately designed friction that makes the dangerous action harder and the safe action easier.
Building Genuine Resilience
Organisations that are genuinely resilient to social engineering share several characteristics. They have built a culture in which slowing down is rewarded rather than penalised. They run realistic simulations that reflect the actual sophistication of current attacks and debrief honestly when simulations succeed.
They have made reporting easy and blameless. A simulation that causes embarrassment will produce people who are less likely to report real incidents. A simulation that produces a supportive debrief will produce people who are more likely to report, and more quickly.
Most importantly, they treat social engineering resilience as a leadership priority rather than an IT initiative. Security culture is built by what leadership models and what leadership rewards.
