Social Engineering

Signs it might be this

• The request arrives unexpectedly and asks for a code, password, payment or access.
• The contact discourages you from checking, such as ‘don’t call the bank, they’re involved’ or ‘there’s no time’.
• The channel is new or slightly off: a different number, a similar-looking address, a new account.
• You are asked to move money in unusual ways, such as gift cards, crypto or wire transfers.
• The story leans hard on fear, secrecy or the importance of the person asking.

Signs it is probably something else

• You started the contact, using a number or address you found yourself.
• The request fits a process you already know and can confirm through your own channels.
• They are happy for you to hang up and call back, or to ask a colleague first.
• Nothing sensitive is being asked, such as a code, money, or access.
• Your organization announced the request ahead of time through a known route.
• You can confirm the request through a channel you chose yourself, and it checks out.
• The requester welcomes verification and does not mind a delay.
• The request asks for nothing sensitive and can wait.

Questions to ask yourself

• Can I confirm this request using a number or address I already trust, and not the one it came from?
• Is the person asking me to skip a step that normally exists?
• Why is there no time to check, and who benefits from that?
• Am I being asked for a code, a payment or access, and what would happen if the request were false?
• Is the contact unusual in its channel, wording or timing for this person or organization?

What it is

Social engineering is a request that gets past normal checks by working on people instead of on systems. A caller claims to be from the bank.

A message appears to be from a boss. Someone in a hi-vis vest walks through a door.

The request leans on helpfulness, respect for authority or fear of getting it wrong. Real organizations also make urgent requests, so urgency alone settles nothing.

The test is whether the request can be verified through a channel you already trust.

Why it matters

What gets used is ordinary decency: being helpful, deferring to apparent authority, not wanting to make a fuss. So a loss of money, access or privacy can leave you blaming yourself, instead of seeing that it was done to you.

How it shows up

• A request that comes with a role attached, like bank staff, IT support, a manager, a delivery driver or a government agent.
• A pretext, meaning a made-up reason, that explains why the usual process must be skipped this once.
• Pressure on time or on feelings, such as a deadline, a threat to an account, a relative in trouble, or embarrassment about asking.
• Delivered by phone, text, email, social media, or in person at a front desk or a door.
• Aimed at things people can give freely, like a code, a password, a payment, a keycard, a favor or a piece of personal information.

What you can do

Pick what fits. You do not owe anyone a confrontation.

Words you could use

“Thanks for letting me know. I deal with anything like this through the official number, so I’ll look it up myself and check. If it’s real, it will still be there after I’ve confirmed it.”

Ask about it gently

Say you handle such matters yourself: ‘I’m going to check this through the official number and come back to you.’

Set a clear limit

Decline to share codes or passwords with anyone who contacts you first. A line to try: ‘I don’t give that out in response to a call or message, whoever it is.’

Step back

Close the message, or end the call without explanation. Then contact the real organization using a number from its official site or the back of your card.

Get support

Tell someone you trust right away, even if you feel foolish. If money moved or a password was shared, call your bank’s fraud line and ask for help securing your accounts.

At work, school or with services

Report any odd request to your security or IT team. Set up a rule that payments or access changes need a second person to confirm by a known channel.

Using this label fairly

• Treating every urgent request as a scam can strain relationships and slow honest work. Verification is the test, not a feeling of suspicion.
• Blaming someone who fell for it adds shame to a loss. Good people with good habits get caught by well-built pretexts.

How it differs from look-alikes

Credential-Costuming is about inflated titles and standing over time, while social engineering is a single request that uses a role to get something now. Identity Performances builds a persona over weeks or months.

Here the pretext is usually short-lived and aimed at an action. Performative Allyship / False Solidarity trades on shared values, not on urgency or authority.