How to Recognise Social Engineering Attacks
Not every security threat involves a line of code. Some of the most damaging attacks don't target your computer — they target you. Social engineering is the art of manipulating people into handing over access, passwords, or sensitive information. And it works because humans are naturally trusting.
Phishing: the most common bait
Phishing emails pretend to be from a legitimate company — your bank, a delivery service, a streaming platform — and ask you to click a link or download an attachment. The link goes to a convincing fake login page that steals your credentials. Look for tell-tale signs: generic greetings ("Dear Customer"), urgent language ("Your account will be suspended"), grammatical errors, and sender addresses that don't quite match the real domain.
Pretexting and vishing
Pretexting happens when an attacker fabricates a scenario to get information from you. For example, someone posing as IT support calls and asks for your password to "fix an issue." This is called vishing (voice phishing). Legitimate IT staff will never ask for your password. Hang up and call the official support line to verify.
Trust no request out of the blue: A password manager like NordPass helps here too — it autofills credentials only on the real site, so if a phishing link sends you to a fake login page, your password manager simply won't offer to fill in your details.
Baiting and quid pro quo
Baiting dangles something tempting — a free download, a "lost" USB stick, a too-good-to-be-true offer — in exchange for access. Quid pro quo offers a service in return for information, like a "free security audit" that asks for your login details. If an offer feels suspicious, it probably is.
How to protect yourself
The best defence is a healthy dose of scepticism. Verify unexpected requests through a separate channel. Never share passwords, PINs or verification codes with anyone. Use unique passwords for every account and enable multi-factor authentication everywhere you can.