Social engineering: methods and defense in companies

Social engineering is manipulation instead of technology

Social engineering refers to attacks that do not work through a technical gap but through the person in front of it. The Federal Office for Information Security (BSI) lists this attack vector in its IT-Grundschutz Compendium as elementary threat G 0.42 and describes it as a method of gaining unauthorized access to information or IT systems through social actions. On its topic page for companies, the BSI becomes more specific: criminals induce their victims to disclose data on their own, to bypass protective measures, or to install malware themselves.

That is precisely where the difference from a classic hack lies. Nothing is overcome; something is permitted. A correctly configured authorization system does not help if the authorized person voluntarily passes on the password.

The methods that reach everyday working life

Almost all variants follow the same blueprint: a credible role, a plausible occasion, a tight time frame. Only the channel differs.

Phishing — fraudulent emails that pose as a reputable provider and lead to fake login pages. The BSI describes the term as an artificial word made up of password and fishing.
Spear phishing — the same technique, but tailored to a single person with considerable effort; according to the BSI, often the opening move of a staged attack chain.
Vishing — the attack by phone, for example in the name of the bank, the police, or internal IT support.
Smishing — the same scam via text message or messenger, usually in the name of a parcel service or shop.
CEO fraud — police crime prevention describes the scam as fraudsters posing as an executive of a company in order to trigger an urgent payment. Internationally, the same class of attack is known as Business Email Compromise.
Pretexting, baiting, tailgating — the invented backstory, the prepared USB stick in the parking lot, following an authorized person through the access door. These terms are established in technical language but are not defined as terms in their own right on the relevant BSI pages.

What is new is the channel, not the principle. In its guidance on deepfakes, the BSI already describes the case of a person being called with the cloned voice of their manager in order to trigger a financial transaction. Since August 2, 2026, the transparency obligations of Article 50 of the EU AI Act have applied; for providers that placed their generative systems on the market before that date, the labeling under paragraph 2 only takes effect from December 2, 2026, as a result of the Digital Omnibus Regulation (EU) 2026/1744. This changes little for attackers, because those who commit fraud do not label. What the labeling obligation requires in legal terms is set out in detail elsewhere: Labeling obligation for chatbots under Article 50.

Why it works: four levers

Social engineering targets traits that are desirable in everyday working life. For the consumer sphere, the BSI expressly names helpfulness, trust, fear, and respect for authority. The same mechanisms operate in companies, although time pressure regularly takes the place of trust:

Authority. An order from above is questioned less often than one from the next desk.
Time pressure. Anyone who has to deliver in ten minutes does not check the sender address.
Helpfulness. The colleague who is supposedly locked out has the door held open for them.
Fear. The threatened account suspension creates exactly the panic in which nobody thinks anymore.

That is why the question Who fell for it? is the wrong one. Attentiveness is a matter of the day's form, not a character trait.

How employees recognize an attack

The reliable warning signs are unspectacular and recur: a request that is urgent and at the same time is supposed to remain secret; a request to bypass the usual route; a sender whose domain differs by one character; an attachment or link that nobody announced; a follow-up question that is unwelcome. For the email channel, the characteristics are compiled in detail under eight warning signs of a phishing email.

How large this attack channel is can be seen from a figure in the Federal Criminal Police Office's Federal Situation Report on Cybercrime 2025: for the 2025 reporting year, the Phishing Radar of the North Rhine-Westphalia consumer advice center received around 382,470 reported phishing emails (published on May 12, 2026). In its report on the state of IT security for the period July 2024 to June 2025, the BSI continues to describe the situation as tense (published on November 11, 2025).

More important than any checklist is the second channel. A payment instruction that arrives by email is confirmed by phone — using the known number, not the one in the email.

Where awareness-raising is legally required

Since December 6, 2025, awareness has no longer been a voluntary measure for a considerably expanded group of entities. With the NIS-2 implementation act, a new version of the BSI Act (BSIG) applies; the BSI puts the number of regulated entities at around 29,500 instead of around 4,500 previously. The catalog of minimum measures in Section 30 BSIG expressly lists basic training and awareness-raising measures as a separate item, and Section 38 BSIG obliges management to implement the measures, to monitor their implementation, and to take part in training regularly themselves. Which entities are affected and what has changed compared with the previous rules is broken down in the comparison NIS-2 vs. NIS-1 and IT-SiG 2.0.

Data protection applies independently of this. Article 32 of the General Data Protection Regulation (GDPR) requires technical and organisational measures at a level appropriate to the risk — awareness-raising is one such organisational measure, even if the provision does not name it explicitly. Article 39 (1) lit. b, by contrast, names it expressly: according to it, the monitoring of compliance by the data protection officer also includes the awareness-raising and training of staff involved in processing operations. It must be possible to prove that training has taken place; which details such proof must contain is set out in Proving mandatory training.

Social engineering, phishing, and security awareness clearly distinguished

The three terms are often used synonymously but refer to different levels. Social engineering is the class of attack, i.e., the principle. Phishing is a subset of it, namely a specific channel that is usually rolled out on a mass scale — all phishing is social engineering, but not all social engineering is phishing. Security awareness is on the other side of the equation: it is not the threat but the organizational response to it. How such a program is set up and kept alive over time is described in the article on building an awareness program; Microlearning classifies short, recurring formats for it.

Is social engineering the same as phishing?

No. Social engineering is the umbrella term for attacks that manipulate people. Phishing is one of its forms, namely the route via fake messages and login pages. A call from supposed IT support or following someone through an access door are also social engineering, but not phishing.

What role do deepfakes and cloned voices play?

They lower the cost of credibility. The BSI describes the case of employees being called with the cloned voice of their manager in order to trigger a payment. The principle remains CEO fraud; only the pretext seems more convincing. The countermeasure remains the same: calling back via a known second channel.

Are companies legally obliged to raise their employees' awareness?

For entities within the scope of the new BSI Act, yes: Section 30 BSIG lists basic training and awareness-raising measures in the catalog of minimum measures. Independently of this, Article 32 GDPR gives rise to the obligation to take appropriate organisational measures, and Article 39 GDPR expressly names awareness-raising as a monitored task.

How often should awareness measures be repeated?

No specific cycle is prescribed for awareness; neither the BSI Act nor the General Data Protection Regulation specifies an interval in months or years — Section 38 BSIG does, however, expressly require regular participation by management. From a professional standpoint, the case for short, recurring units is that attack patterns and channels change constantly — a one-off annual training course no longer reflects the current state after a few months. It therefore makes sense to align the rhythm with identifiable occasions: new waves of attacks, changed processes, new employees.

What should you do if someone has already clicked?

Report it immediately, do not hide it. The sooner IT security is informed, the sooner access can be blocked and sessions ended. An error culture in which a click does not raise the question of blame is more effective at this point than any additional technical measure.

All sources retrieved on 6 Aug 2026 unless otherwise stated in the entry. For provisions on gesetze-im-internet.de, the legal status of 6 Aug 2026 applies; retrieval there was not technically possible.

Social engineering: methods, examples, and defense in companies

Social engineering is manipulation instead of technology

The methods that reach everyday working life

Why it works: four levers

How employees recognize an attack

Where awareness-raising is legally required

Social engineering, phishing, and security awareness clearly distinguished

FAQ

Is social engineering the same as phishing?

What role do deepfakes and cloned voices play?

Are companies legally obliged to raise their employees' awareness?

How often should awareness measures be repeated?

What should you do if someone has already clicked?

Sources

More blog posts

Introducing a phishing simulation: the process in seven steps

NIS-2, NIS-1, and IT-SiG 2.0: What is actually new

Building a security awareness program: microlearning, KPIs, frequency