What Is Social Engineering? The Art of Hacking People

How Twitter's Most Verified Accounts Got Hijacked in an Afternoon

In July 2020, the Twitter accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Kanye West, and Apple all posted the same Bitcoin scam within a few minutes of each other. Millions of followers watched accounts they trusted ask them to send cryptocurrency to a wallet address, promising to double it. The scam collected over 100,000 dollars before Twitter could lock the accounts down.

Nobody broke Twitter's servers. Nobody found a software bug. A group of attackers called Twitter employees on the phone, claiming to be from the company's IT department dealing with a VPN problem during the shift to remote work. They walked a handful of employees through a fake login page that captured their credentials, then used that access to reach an internal admin tool built for moderating accounts. From there, they could reset any account's email and take it over directly. The strongest technical stack in the world did not matter, because a person with the right access believed a convincing story on the phone.

What Social Engineering Actually Means

Social engineering is the practice of manipulating a person into taking an action or revealing information that benefits an attacker, rather than attacking a system directly. Instead of guessing your password or exploiting a firewall hole, the attacker convinces you, or someone with access to your account, to just hand it over. It is the technique behind the large majority of breaches that make the news, because human judgment is far easier to bend under the right conditions than encryption is to break.

This is why social engineering sits underneath so many other attacks you may have already read about: phishing is social engineering delivered by email or text. SIM swapping usually starts with a social engineering call to a mobile carrier's support desk. Business email compromise, one of the costliest categories of cybercrime by dollar losses, is almost entirely social engineering with no malware involved at all.

The Psychological Levers Attackers Pull

Social engineering works because it targets instincts that are useful in normal life and become liabilities under manipulation:

• Authority. Most people comply faster with someone who sounds like a boss, a police officer, a bank fraud investigator, or an IT administrator. Attackers borrow that authority by claiming a title, not by proving one.
• Urgency. "Your account will be suspended in the next hour" or "wire this payment before the bank closes" removes the time a person would normally spend double-checking. Rushed decisions skip verification.
• Reciprocity. A small favor first, holding a door, answering a simple question, sending a helpful looking attachment, creates a mild social debt that makes the next, bigger request feel less unreasonable.
• Social proof. "Everyone on your team already filled this out" makes an unusual request feel routine.
• Fear of consequences. Threats of being blamed for a mistake, getting a coworker in trouble, or facing legal action push people to comply quietly instead of asking questions out loud.

None of these require the target to be careless or unintelligent. They exploit conditions, not character. Security researchers and IT staff, people who know better in the abstract, still get caught by well-run social engineering campaigns because the pressure is applied in the moment, not in a calm reflective one.

Five Tactics You Will Actually Run Into

• Pretexting: inventing a plausible scenario to justify a request, such as posing as a new vendor who needs an invoice paid or as internal IT resolving a login issue. The fabricated context is what makes an unusual request feel normal.
• Baiting: dangling something tempting, a gift card, a free download, or a USB drive left in a parking lot labeled "Payroll 2026", that carries malware or a credential-harvesting link once opened or plugged in.
• Tailgating: physically following an employee through a badge-locked door while carrying boxes or looking busy, relying on politeness to avoid being questioned.
• Business email compromise (CEO fraud): an email that appears to come from an executive, often using a lookalike domain, instructing an employee to urgently wire funds or buy gift cards. The FBI has tracked losses from this single tactic in the billions of dollars.
• Helpdesk impersonation: calling a company's support desk pretending to be a locked-out employee, using publicly available details (a name from LinkedIn, a department from a press release) to sound legitimate enough for a password reset.

A Helpdesk Impersonation Attack, Step by Step

This is roughly how the Twitter incident, and many corporate breaches since, actually unfold in practice:

1. The attacker researches a target company on LinkedIn and its own website, gathering employee names, job titles, and internal terminology.
2. They call the company's IT helpdesk claiming to be one of those employees, mentioning a plausible detail (a recent software rollout, a manager's name) to sound like an insider.
3. They claim to be locked out ahead of an urgent deadline, applying just enough pressure that the support agent wants to help quickly rather than escalate.
4. The agent resets a password or multi-factor method, sometimes routing the new code to a phone number the attacker controls.
5. The attacker logs in with legitimate looking credentials, and because the access came through a normal reset process, it does not immediately trigger the alerts a brute-force attempt would.

Notice that no password was cracked and no vulnerability was exploited. The "hack" was a five-minute phone call.

Detection Habits That Actually Hold Up

• Treat urgency as a warning sign, not a reason to hurry. Legitimate requests survive you calling back in ten minutes. Scams are built around you not doing that.
• Verify through a channel the requester did not provide. If "your bank" calls, hang up and dial the number printed on your card. If "your CEO" emails an urgent wire request, call their known number directly. This single habit defeats most social engineering, technical sophistication or not.
• Never read out a one-time code or password to anyone who calls or messages you. No legitimate support agent, bank employee, or IT department will ever ask for your 2FA code. A request for one is, by itself, proof of an attack in progress.
• Assume public information is attacker research material. Job titles, org charts, vacation announcements, and those "answer these 10 questions about yourself" social posts all hand pretexting attackers exactly what they need to sound credible.
• Push toward phishing-resistant authentication where you can. Passkeys and hardware security keys cannot be read aloud over the phone or typed into a fake page, which removes the one thing most social engineering ultimately tries to extract.

Frequently Asked Questions

Is social engineering the same thing as phishing?

Phishing is one delivery method for social engineering, specifically the version that uses fake emails, texts, or websites. Social engineering is the broader category and also includes phone-based attacks (vishing), in-person impersonation, and the helpdesk-style attacks described above. All of them target a person's judgment rather than a system's code.

Why did Twitter employees, who presumably had security training, fall for it?

Because the attack was built around urgency and a plausible internal-sounding pretext delivered during a period (the early pandemic remote-work shift) when unusual IT requests were genuinely common. Training reduces risk, it does not make anyone immune, especially when the pressure is applied live and the story fits the moment.

Can two-factor authentication stop social engineering?

It stops the specific case where an attacker only has your password. It does not stop an attacker who convinces you, or a support agent, to read out or reset the second factor itself. That is exactly why the Twitter attackers went after an internal admin tool instead of guessing passwords, and why phishing-resistant methods that cannot be verbally extracted are a meaningfully stronger backstop.

What is the single biggest tell that a request is a social engineering attempt?

Manufactured urgency paired with a request to skip your normal verification step. "Do this right now, and don't check with anyone else first" is close to a universal signature across pretexting, CEO fraud, and helpdesk impersonation alike.

How do organizations defend against this at scale?

Strict callback verification procedures for any support desk request that touches account recovery, so an agent cannot be talked into a reset on a single phone call, least-privilege access so one fooled employee cannot reach everything, ongoing simulated-phishing training, and phishing-resistant authentication for anyone with elevated access. It is the human-facing half of a broader zero trust security posture.