How social engineering works
Attackers research a target, then build a believable pretext: a supplier invoice, an IT helpdesk call, a message from an executive. They create urgency or authority so the victim acts before thinking.
The goal may be credentials, a payment, malware execution or physical entry. Channels include email, text messages, phone calls, social media and in-person visits. Many major breaches begin with a single successful manipulation of an employee. Attacks often chain several steps, such as a friendly call followed by a fake email, so each interaction looks routine while the combined effect gives the attacker what they need.
Why it matters for Canadian organizations
Social engineering bypasses firewalls and endpoint tools because the victim performs the action willingly. Business email compromise and credential theft remain common routes into Canadian organizations of every size.
The Canadian Centre for Cyber Security consistently identifies phishing and related deception as a leading way attackers gain access. A successful attack involving personal information can trigger breach notification duties under PIPEDA and Law 25. Small and mid-sized businesses are not exempt, because attackers choose targets that are easy and profitable, and employees in finance, HR and reception are common entry points.
How to defend against it
Combine awareness training with technical controls. Run realistic phishing simulations, teach staff to verify unusual requests through a second channel, and make reporting easy and blame-free.
Enforce phishing-resistant multi-factor authentication, email filtering, strict payment-change procedures and visitor controls. Limit what any single employee can approve alone, so one deceived person cannot cause serious loss. Treat these controls as layers rather than a single fix, and regularly measure results such as reporting rates and simulation click rates to see whether behavior is actually improving.
Frequently asked questions
What are common examples of social engineering?
Common examples include phishing emails, vishing phone calls, pretexting as IT support, baiting with infected USB drives, tailgating into secured buildings, and fake invoices or executive requests used in business email compromise. Awareness is important for everyone in the organization.
Is phishing a type of social engineering?
Yes. Phishing is social engineering delivered through email or messages. Social engineering is the broader category, which also includes phone calls, in-person tactics and impersonation that do not involve any email at all. Security teams should plan for both.
Can technology stop social engineering?
Technology reduces exposure through email filtering, MFA and payment controls, but it cannot stop every attempt. Trained, alert employees and clear verification procedures are needed alongside tools, since the attack targets human decisions. Layered defenses are the most reliable approach.
Related service: Phishing simulation