Psychological manipulation aimed at deceiving an individual into disclosing information or performing an unauthorized action, without any technical exploit.
Social engineering encompasses all psychological manipulation techniques by which an attacker deceives an individual by exploiting trust, authority, urgency or fear, to induce them to disclose sensitive information or perform an action that benefits the attacker, without resorting to any technical exploit on computer systems. Pretexting involves fabricating a credible scenario, for example posing as an auditor, an IT contractor or a line manager, in order to obtain access or information. Vishing (voice phishing) uses a telephone call with a spoofed identity. Business Email Compromise (BEC) attacks often combine social engineering and email spoofing to convince a colleague to make a fraudulent wire transfer to an account controlled by the attacker. The emergence of voice and video deepfake technology has considerably enhanced the credibility of social-engineering attacks by enabling convincing imitation of an executive's voice or face. For cyber insurance, social engineering raises a boundary issue between cyber cover and conventional fraud cover, depending on whether the fraudulent act involves a prior computer compromise.
In 2024, a Hong Kong financial services firm loses 25 million dollars after a finance employee is convinced, during a video conference populated by deepfake avatars impersonating his colleagues and CFO, to make a series of wire transfers to fraudulent accounts.
social engineering, ingénierie sociale, pretexting, BEC, manipulation psychologique