What Is Social Engineering? How Hackers Manipulate People

Introduction: The Hack That Never Touches Your Computer

In 2011, RSA Security one of the most respected names in cybersecurity suffered one of the most damaging breaches in corporate history. Attackers did not exploit a zero-day vulnerability. They did not break through an enterprise firewall. They sent a single Excel file titled “2011 Recruitment Plan” to a small group of employees. One person opened it.

Thank you for reading this post, don't forget to subscribe!

That single action gave attackers access to RSA’s internal systems and ultimately compromised the security of millions of SecurID authentication tokens used by governments and corporations worldwide.

The technical exploit was secondary. The real weapon was human psychology.

This is social engineering and it is the method behind the majority of successful cyberattacks in the world today. You can have the best antivirus software, the strongest firewall, and a fully patched operating system. None of it matters if an attacker can convince you to hand over access yourself.

This guide explains exactly what social engineering is, how it works, the most common techniques being used right now including in Nepal and the concrete defenses that actually work.

What Is Social Engineering in Cybersecurity?

Social engineering is the psychological manipulation of people into performing actions or revealing confidential information that compromises security. Rather than exploiting software vulnerabilities, attackers exploit human vulnerabilities trust, fear, urgency, curiosity, and the natural desire to be helpful.

The term “social engineering” in a security context was popularized by Kevin Mitnick, once the FBI’s most wanted hacker, who argued that the human element is always the weakest link in any security system. Decades later, that observation is still accurate.

According to the Verizon Data Breach Investigations Report, the vast majority of successful breaches involve a human element whether through stolen credentials, phishing, or direct manipulation. The technology gets more sophisticated every year. Human nature does not change.

Why Social Engineering Works

Attackers do not need to be technical geniuses to pull off social engineering attacks. They need to understand how people think. Specifically, they exploit a handful of predictable psychological principles:

• Authority: People comply more readily with requests from figures of perceived authority a manager, a bank officer, an IT department head.
• Urgency: When someone is told they must act immediately or face serious consequences, critical thinking shuts down.
• Scarcity: The fear of missing out or losing something valuable overrides caution.
• Social proof: If an action appears to be what everyone else is doing, people follow without questioning.
• Reciprocity: When someone does something for you even unsolicited you feel compelled to return the favor.
• Familiarity and liking: People are far more likely to comply with requests from people they recognize or like.

These are not weaknesses unique to uninformed users. They are built into human cognition. Security professionals, engineers, and executives have all fallen victim to well-crafted social engineering attacks.

The Most Common Types of Social Engineering Attacks

Phishing

Phishing is the most widespread form of social engineering. An attacker sends a message typically via email, but increasingly via SMS (smishing) or voice call (vishing) that impersonates a trusted entity and prompts the target to take an action: click a link, open an attachment, enter credentials, or transfer money.

Phishing attacks range from mass, untargeted campaigns to highly personalized operations called spear phishing, where the attacker researches a specific target and crafts a message designed specifically for them.

In Nepal, phishing has become the dominant vector for financial fraud. Attackers send WhatsApp and Viber messages impersonating NIC Asia Bank, eSewa, and Khalti, often written in Nepali, warning users of account suspension and directing them to fake login pages.

Pretexting

Pretexting involves creating a fabricated scenario a pretext to extract information or access from a target. The attacker invents an identity and a plausible reason for why they need what they are asking for.

A classic example: an attacker calls an IT helpdesk claiming to be a new employee who cannot access their account, and asks the helpdesk technician to reset their password. If the helpdesk agent does not follow strict verification protocols, the attacker gains access.

In Nepal’s banking context, pretexting often takes the form of callers posing as “bank security officers” who inform a customer their account has been flagged for suspicious activity and that they need to verify their identity by sharing their account details and OTP.

Baiting

Baiting uses the promise of something attractive to lure a victim into taking a risky action. The most famous physical example is leaving infected USB drives in a company parking lot employees find them, become curious, and plug them into their work computers.

Digital baiting includes fake download links for popular software, pirated movies or games that install malware, or fraudulent job offers that require applicants to download a “skill test” file.

Quid Pro Quo

This technique involves offering something of value in exchange for information. An attacker might call employees at a company posing as IT support and offer to help fix a common problem in exchange for the employee’s login credentials so the “support team” can remotely access their machine.

The target receives perceived value. The attacker receives access.

Tailgating and Piggybacking

These are physical social engineering techniques. Tailgating is when an attacker follows an authorized person through a secured door without authorization, often by simply walking closely behind them while carrying something heavy counting on the authorized person to hold the door as a common courtesy.

While less directly relevant to digital banking users in Nepal, tailgating is a serious threat in corporate and government environments, and understanding it reinforces the broader point: social engineering attacks the instinct to be helpful and trusting.

Vishing (Voice Phishing)

Vishing attacks use phone calls to manipulate targets. This technique is particularly effective in Nepal, where trust in phone-based authority figures remains high and awareness of this attack vector is low.

A common pattern reported in Nepal: the attacker calls posing as a telecom company (NTC or Ncell) and informs the target that their SIM is due for expiration or has been flagged for misuse. They offer to help and in the process, extract the OTP needed to take over the target’s linked financial accounts.

A Social Engineering Attack in Nepal: A Realistic Example

Consider the following scenario, which reflects the structure of real incidents reported to Nepal Police Cyber Bureau:

Step 1 Reconnaissance: An attacker scrolls through public Facebook posts in a Kathmandu-based community group. They find a post from a user mentioning they recently opened a Nabil Bank account. The user’s phone number is visible in their profile.

Step 2 Pretext construction: The attacker prepares by noting the user’s name, rough location, and bank. They rehearse a script designed to create immediate fear.

Step 3 The call: The attacker calls, identifying themselves as “Nabil Bank’s fraud prevention team.” They tell the target that a transaction attempt was made from their account from an IP address in India. To stop the transaction and secure the account, the target must verify their identity by confirming their account number and the OTP being sent to their phone.

Step 4 OTP capture: The attacker, already logged in to a portal with the target’s account number (obtained from another source or guessed), triggers a legitimate OTP. The target receives it and reads it out, believing they are protecting their account.

Step 5 Account takeover: Within seconds, the attacker uses the OTP to complete the transaction. The call ends. The money is gone.

The entire attack required no malware, no hacking tool, and no technical expertise. It required a phone and the ability to sound authoritative.

Social Engineering in the Workplace: Why Organizations Are Vulnerable

Individual users are not the only targets. Organizations face social engineering risks at every level, and the consequences of a successful attack on a business or institution are far greater.

The Insider Threat Angle

Sometimes social engineering does not target an organization from the outside it targets a current or former employee who already has access. Disgruntled employees, contractors, or individuals who have been manipulated or coerced over time can become unintentional or intentional insider threats.

Business Email Compromise (BEC)

Business Email Compromise is an advanced form of social engineering where attackers either spoof or fully compromise a business email account and use it to authorize fraudulent financial transfers. The FBI has identified BEC as one of the costliest forms of cybercrime globally.

In a typical BEC attack, an attacker who has studied a company’s operations sends an email that appears to come from the CEO, instructing the finance department to wire funds to a new account for an urgent deal. Because the request comes from a trusted email address and uses familiar language, it bypasses both technical filters and human skepticism.

Pro Tips: How to Defend Against Social Engineering

Pro Tip 1: Slow down before you act Urgency is an attacker’s most powerful tool. Any message, call, or situation that pressures you to act immediately without time to think is a red flag. Pause. Verify. Then decide.

Pro Tip 2: Verify identity through a separate channel If you receive a call from your bank, do not trust the caller’s contact information. End the call, find the bank’s official number from their website or the back of your card, and call back yourself to confirm whether the situation is real.

Pro Tip 3: Establish a verification culture in your organization Businesses should implement strict identity verification protocols for any request involving access changes, financial transfers, or sensitive data regardless of how authoritative the requester sounds or how senior they appear to be.

Pro Tip 4: Treat unsolicited help with suspicion If someone contacts you offering to solve a problem you did not report, or provides assistance you did not ask for, approach it with caution. Quid pro quo attacks depend on the target feeling grateful before they realize they have been exploited.

Pro Tip 5: Limit your digital footprint The more personal information available about you online your bank, employer, location, daily routine the easier it is for an attacker to craft a convincing pretext. Audit your social media privacy settings regularly.

Pro Tip 6: Security awareness training is not optional For organizations, a single untrained employee is a door left unlocked. Regular, realistic social engineering simulations including fake phishing tests are among the most effective ways to build institutional resilience against these attacks.

The Psychology Behind the Defense

Understanding the psychological principles attackers exploit is itself a defense mechanism. When you know that someone using urgency, authority, or fear is trying to shut down your critical thinking, you can consciously override that impulse.

This is why cybersecurity researchers argue that the best firewall for social engineering is not a product it is a mindset. A practiced habit of verification. A healthy skepticism toward unsolicited contact. The discipline to slow down even when every instinct is telling you to act fast.

In Nepal, where digital literacy is growing but cybersecurity education has not kept pace, this mindset needs to be built through community awareness, school programs, and media coverage of real incidents.

What Ethical Hackers Learn From Social Engineering

In the world of ethical hacking and penetration testing, social engineering is a legitimate and essential skill. Certified ethical hackers and red team professionals conduct authorized social engineering assessments including phishing simulations, pretexting exercises, and physical security tests to help organizations identify and fix their human vulnerabilities before real attackers exploit them.

This is covered in certifications such as CEH (Certified Ethical Hacker), OSCP, and the social engineering frameworks taught in offensive security training. Understanding how attacks are constructed from an attacker’s perspective is foundational to building effective defenses.

More Links:

• How I Found Critical Vulnerabilities in Nepal’s Government App
• Instagram Account Hacked? Complete Recovery Guide 2026 (All Methods That Actually Work)

• Social Engineering Framework by Security Researchers: https://www.social-engineer.org A comprehensive resource maintained by professional social engineering practitioners used widely in security training

FAQ Section