Social Engineering Attacks: Train Staff to Spot Them
Social engineering attacks skip the firewall and go straight for your people: a friendly caller from "IT", a text from "the CEO", a visitor with a clipboard. These 12 practical tips help you train staff to recognize the tricks and give them simple rules that make saying no feel normal.
Key takeaways
- Social engineering exploits trust, urgency, authority and helpfulness, not technical flaws.
- Teach staff to recognize the emotional pressure, not just memorize examples.
- Give clear rules: verify through a second channel, never share codes or passwords, never approve payments on a voice or video alone.
- Make reporting quick and blame-free, and thank people who report.
- Short, regular sessions beat one long annual lecture.
Social engineering is the art of persuading someone to do something that helps an attacker: share a password, read out a one-time code, open a file, hold a door, change bank details or approve a payment. It works on smart, careful people because it uses normal human instincts. Most of us want to be helpful, respect authority and avoid getting someone into trouble.
That is why technical controls alone are not enough. Multi-factor authentication, email filtering and endpoint protection all help, but a well-crafted phone call can talk someone through switching them off. Your staff are the last line of defense, and with the right habits they are a very effective one. Our guide to spotting phishing covers email in detail; this article looks at the wider set of tricks across phone, text, video and in person, and how to train people to handle them.
Understand the psychology first
Every social engineering attempt pulls one or more emotional levers. When staff can name the lever, they can notice it working on them and pause.
1. Teach the four pressure buttons
| Lever | What it sounds like | Safe response |
|---|---|---|
| Urgency | "This has to go out in the next 20 minutes." | Slow down. Genuine deadlines survive a call-back. |
| Authority | "I'm calling from the bank's fraud team." "This is the director." | Verify identity on a known number before acting. |
| Helpfulness | "I'm locked out and my client is waiting, can you help?" | Follow the normal process, however sympathetic the story. |
| Fear or secrecy | "Your account will be closed." "Don't tell anyone yet." | Treat secrecy as a red flag and tell a manager. |
2. Focus on the request, not the story
Attackers are good storytellers, and staff can get lost in the details. Teach a simpler test: ignore the story and look at what you are being asked to do. If the request involves money, credentials, codes, personal data, remote access or physical entry, it needs verification through a channel you choose, no matter how convincing the story sounds.
Pro tip
Give staff a short phrase they can use without feeling rude, such as "No problem, I'll call you back on the number we have on file." A ready-made script makes it far easier for junior staff to say no to someone who sounds senior.
Phone and voice attacks
3. Never read out a one-time code
Callers posing as a bank, a supplier or your IT provider often ask the victim to "confirm" a code just sent to their phone. That code is usually the second factor that lets the attacker log in or approve a payment. Make the rule absolute: nobody legitimate will ever ask you to read out a login or payment code.
4. Hang up and call back on a known number
Caller ID can be faked, and an incoming call is not proof of who is calling. If someone claims to be from your bank, a supplier or a government department, end the call and phone back using a number from your own records or an official source. Wait a moment or use a different phone before calling back.
5. Prepare for cloned voices and fake video
AI can clone a voice from a short audio clip and fake a video call. A message that sounds exactly like your manager is no longer proof that it is your manager. Agree on code words or verification questions for payment and access requests, and make it a firm rule that payments are never approved on the strength of a voice or video alone. Our guide to deepfake scams covers this in more depth.
Text, chat and QR code tricks
6. Treat texts from "the boss" with suspicion
Smishing (SMS phishing) messages often pretend to come from a delivery firm, a bank or the CEO. A classic version is "I'm in a meeting, can you buy some gift cards for a client and send me the codes?" Teach staff that unusual requests by text, WhatsApp or chat from a senior person should be checked by calling that person on their known number.
7. Check before scanning QR codes
Quishing (QR phishing) uses fake QR stickers on parking meters or payment signs, and QR codes in emails designed to slip past filters. Teach staff to check the URL preview before opening a link from a QR code, and never to enter a password or payment details on a page reached by scanning one. If a QR code arrives in a work email asking you to log in, report it.
Common mistake
Training people only on email. Attackers move between channels: an email followed by a "confirming" phone call, or a text followed by a fake login page. Staff need to know that any channel can be used, and that one channel cannot verify another that the attacker might also control.
In-person and physical tricks
8. Make it normal to challenge visitors
Someone in a high-visibility vest or carrying a box can often walk straight in behind a member of staff, a trick called tailgating. Set simple rules: visitors sign in and are accompanied, doors are not held open for strangers in secure areas, and anyone can politely ask "Can I help you find someone?" without fear of embarrassment.
9. Lock screens and clear desks
A visitor only needs a moment at an unlocked computer or a glance at a password on a sticky note. Set automatic screen locks, teach staff to lock their screen when they step away, and keep sensitive papers out of sight.
10. Do not plug in unknown devices
USB drives left in car parks or sent as "free gifts" are an old trick that still works. Tell staff never to plug in a device they did not get from your own IT process, and hand found devices to whoever manages IT.
The same caution applies to people who arrive claiming to service equipment, read meters or collect old computers. Ask for the visit to be confirmed in advance by the company that booked it, check identification against that booking, and never hand over devices or storage without a documented process for wiping or disposing of them. A friendly, routine check is not an insult to a genuine contractor, and it quietly defeats a fake one.
Build habits that last
11. Train little and often
Short, regular sessions work better than a once-a-year lecture. Use a ten-minute slot in a team meeting each month to discuss one real-world trick. Free resources include the NCSC's "Top Tips for Staff" e-learning in the UK and CISA's awareness resources in the US. If you run simulated phishing or phone tests, use them to teach, never to shame.
Example
Imagine a small accounting practice, Fenwick Accounts, where the receptionist gets a call from "Dave from IT support" saying he needs to install an urgent update and asking her to open a remote access tool. She remembers last month's ten-minute session, says she will call him back on the IT provider's number from the contact sheet, and hangs up. The real IT provider has no Dave and no urgent update. She reports the call, the owner thanks her at the next team meeting, and the story becomes the example for the following month's session.
12. Make reporting easy and celebrate it
Give people one simple way to report anything suspicious: a dedicated email address, a chat channel or simply a named person to tell. Respond quickly, thank them publicly and share what you learned. In the UK, suspicious emails can also be forwarded to [email protected], and scam texts to 7726 for free. When staff see that reporting is praised, they report sooner, which matters far more than never making a mistake.
Your social engineering training checklist
- Explain the four pressure levers: urgency, authority, helpfulness and fear
- Teach the "focus on the request" test for money, codes, data and access
- Rule: never read out a one-time code to anyone
- Rule: hang up and call back on a known number
- Code words or verification questions for payment requests
- No payments approved on a voice or video alone
- Check unusual texts from senior staff by phone
- Check URL previews and never log in from a QR code
- Visitor sign-in and a polite challenge culture
- Automatic screen locks and no unknown USB devices
- Monthly ten-minute sessions using free NCSC or CISA material
- One easy reporting route, with praise for reporters
Frequently asked questions
What is social engineering in simple terms?
It is manipulating people into giving away access, information or money by pretending to be someone trustworthy. Instead of breaking into systems, the attacker persuades a person to open the door for them.
What are the most common types of social engineering attacks?
Phishing emails, smishing texts, phone calls posing as banks or IT support (often called vishing), QR code scams, impersonation of senior staff or suppliers, and in-person tricks such as tailgating into an office. AI voice cloning is making phone-based attacks more convincing.
How often should we train staff on social engineering?
Little and often works best. A short session each month, plus a briefing for every new starter, keeps the topic fresh without overwhelming anyone. Update the content when you hear about a new trick targeting businesses like yours.
Should we punish staff who fall for a test?
No. Shaming people makes them hide mistakes, which turns a quick fix into a serious incident. Use tests to teach and focus on how fast people report, not whether they ever click.
Related reading
The bottom line
Social engineering attacks target the habits that make your team good at their jobs: being helpful, responsive and respectful of authority. You do not need to make staff suspicious of everyone. You need to give them a few firm rules, a polite script for saying "I'll call you back", and a culture where pausing and reporting are praised.
Start with one ten-minute session this month on the four pressure levers and the call-back rule. It is one of the cheapest security improvements you can make.
