social engineering

basicwidespread

Social engineering is a type of fraud that does not break into the machine but deceives the person into giving up data, money, or access.

In plain terms

A burglar does not need to break the lock if they convince the building manager to open the door for them. Social engineering does the same in the digital world: the attacker does not target the technology, but exploits your trust, helpfulness, or fear.

Typically, someone pretends to be someone else: a bank clerk, a courier company, your boss, a system administrator, or even your child. They urge, frighten, or promise rewards so you have no time to think.

Artificial intelligence has made this old trick cheaper and more convincing. Flawless Hungarian letters, cloned voices, and lifelike fake videos can now be created in minutes. Linguistic errors and strange voices are no longer reliable warning signs.

A new development is that it is no longer only humans who can be deceived this way. An AI agent can also be tricked by misleading text into doing something its owner did not intend.

How it works

Reconnaissance: the attacker gathers what can be publicly known about you or your company, for example from social media, the company website, or leaked databases.
A credible story: it invents a role and a pretext, for example, "we detected a suspicious transaction on your account." With AI, it can also create personalized text, voice, or video for this.
Contact and pressure: reaches out via phone, email, SMS, or chat, playing on urgency, authority, fear, or helpfulness.
The requested step: persuades the victim to provide a password or code, transfer money, install a program, or grant physical access.
Exploitation: using gained access to steal money or data, and often launching further attacks from the compromised account against your friends or colleagues.

An everyday example

Someone calls from "your bank's security department", knows your name, and says they are trying to withdraw your money right now. They ask you to quickly transfer the amount to a "security account" or dictate the code received via SMS. The bank never asks for this: hang up and call the bank back using the number on your card.

Who is affected

everyoneAnyone can be called or contacted by scammers, and the attack depends not on your technical knowledge but on a moment of inattention.

bank customer, investorThe goal of most such scams is to get you to approve the transfer yourself or reveal your login credentials. → Money

employeeCorporate systems are often breached through the password or click of a single deceived colleague. → Work & HR

entrepreneur, executiveOn behalf of leaders, urgent transfers requested via cloned voice or fake video calls can cause serious damage.

A common misconception

MythOnly gullible people or those unfamiliar with IT fall for such scams.

In realityA well-constructed attack exploits fatigue, haste, and respect for authority, so it regularly deceives even skilled professionals and leaders. It is not intelligence that protects you, but the established control rule.

Limits and risks

Antivirus and firewall alone do not protect, because the attack tricks you into voluntarily taking the requested step.
Voice, face, and flawless phrasing no longer prove who is on the other end of the line, as all three can be faked with AI.
Urgency is the most important warning sign: if an immediate decision is demanded from you, stop and verify the request through another channel known to you.
If you use an AI agent, expect that hidden instructions in a website or email could deceive it, so do not grant it more permissions than necessary.

Similar, but not the same

phishing – Phishing is a type of social engineering: it extracts data using a false message, often a fake website or infected attachment. Social engineering is broader, encompassing all deception-based attacks.
hacking – Hacking in the narrower, technical sense exploits weaknesses in software or networks, while social engineering exploits human ones. Real attacks often combine both.
prompt injection – Prompt injection deceives the language model or the agent with a hidden instruction, while social engineering originally targets the human.

Related concepts

Broader

cybersecurity, cyberattack, fraud

Narrower

phishing, spear phishing, phone fraud, CEO fraud

On the edge

deepfake, voice cloning, prompt injection, two-factor authentication, Identity theft, disinformation

A brief history

Fraud based on deception is as old as humanity; the term's meaning in information security spread from hacker culture. It was widely popularized by former hacker Kevin Mitnick, whose book on the subject, The Art of Deception, was published in 2002.

Where things stand

By the end of 2026, social engineering is one of the most common starting points for cyberattacks and online scams. Generative AI enables fake messages, voices, and videos to be produced in large quantities, personalized, and in fluent Hungarian, and AI agents have already appeared among the targets of attacks.

Status: 2026 November

Also known as

social engineering · psychological manipulation · psychological influence · deception-based attack · human-factor-based attack · social engineering · human hacking · social engineering attack

Sources

NIST Computer Security Resource Center – Glossary: social engineering

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.