Social engineering
human hacking · pretexting · baiting · manipulation · MFA fatigue · ingénierie sociale
Manipulation techniques that get a person to bypass security themselves: revealing a password, approving a payment, opening a door or installing software.
In practice
Attackers exploit universal human levers: authority, urgency, helpfulness, fear and reciprocity. They build their story (the “pretext”) from public information such as organisation charts, social media and job adverts. The IT help desk is a prime target because helping people is its job: a password or multi-factor reset granted over the phone can be enough to open up the whole system.
The Scattered Spider group phones help desks or employees while posing as a colleague or as IT support, obtains credentials and multi-factor codes, then steals data and deploys ransomware. CISA and the FBI detailed its methods in advisory AA23-320A, updated in July 2025.
How to protect yourself
- Require the help desk to verify identity robustly before any password or multi-factor reset.
- Train staff with realistic scenarios, including over the phone.
- Limit the internal information you publish (detailed org charts, names of internal tools).
- Openly back any employee who says “let me check and call you back”.
