11 February 2026 | Michael Tchuindjang, Cyber Security Thought Leader and Associate Lecturer in Cyber Security, University of the West of England

Encryption has matured. AI-driven detection systems are now standard. Yet one attack vector still outperforms them all: social engineering. These attacks succeed not because systems are weak, but because humans are predictable under pressure. Fear, trust, urgency, curiosity, and opportunity remain powerful levers; and modern attackers, now armed with AI, exploit them at unprecedented scale. For aspiring cybersecurity professionals, understanding social engineering is foundational. This article explores the latest trends in social engineering attacks, explains why they work, and outlines how defenders can meaningfully prevent them.

1) The Psychology Behind Social Engineering

At its core, social engineering exploits human instincts rather than technical vulnerabilities. Attackers typically rely on one or more of the following triggers:

Authority – “This is Microsoft Support / Your HR department”
Urgency – “Act now or face suspension”
Trust – Long-term relationship building to lower defences.
Fear – Threats of legal, financial, or reputational harm.
Opportunity – Lures involving jobs, investments, or recognition.

Recognising these triggers helps defenders anticipate and disrupt attacks before any harm is done.

2) Modern Social Engineering Scams

2.1 - Phishing: the Backbone of Social Engineering

Phishing is the most prevalent and versatile social engineering technique. Over 60% of major breaches, ransomware incidents, or account takeovers begin with phishing, according to the ENISA Threat Landscape 2025 report [1].

What it is

Phishing is a social engineering technique where attackers impersonate trusted organisations or individuals (banks, employers, colleagues, service providers) to trick victims into revealing credentials, sensitive information, or performing malicious actions. It commonly occurs via email, SMS (smishing), phone calls (vishing), or fake websites.

Why it works

Messages look authentic and professional.
Known brands reduce suspicion.
Urgency prompts impulsive action.
AI creates error-free, highly personalised campaigns.

Red flags

Unexpected requests to verify accounts or reset passwords
Urgent language demanding immediate action
Suspicious links or attachments
Sender addresses or domains that closely resemble legitimate ones
Requests for credentials, MFA codes, or sensitive information

Defensive mindset

Always verify the source independently, urgency and familiarity should never replace verification.

Use case

An employee receives an email appearing to come from Microsoft 365 Security warning of “unusual login activity.” The email contains a link to “secure the account immediately.” The link leads to a cloned Microsoft login page that captures credentials and MFA tokens in real time. Within minutes, the attacker accesses the mailbox and launches internal phishing emails from the compromised account.

Analyst lens / takeaway

Look for credential harvesting domains, real-time MFA token replay, and sudden internal email bursts from a previously normal account. Phishing rarely ends at the initial compromise; it often becomes lateral movement.

2.2 - Romance and Pig Butchering Scams

What it is

Romance and pig butchering scams are long-term social engineering attacks in which adversaries deliberately build emotional or relational bonds with victims over time. Using platforms such as LinkedIn, Instagram, WhatsApp, Telegram, or dating apps, attackers present themselves as trustworthy professionals, friends, or romantic interests, according to the Federal Trade Commission [2]. Once trust is established, the relationship is gradually steered toward financial requests, fake investment opportunities, or operational favors that ultimately benefit the attacker.

Why it works

Long-term trust building: The relationship develops slowly, often over weeks or months, lowering suspicion.
Emotional investment clouds judgment: Victims become emotionally committed, making rational risk assessment more difficult.
AI-enhanced credibility: AI-generated profile images, voice messages, and even deepfake video calls increase perceived authenticity and reduce doubts.

Red flags

Reluctance or repeated excuses to avoid meeting in person or verifying identity
Sudden financial crises or urgent requests for help
Introduction of crypto trading, “exclusive” investments, or high-return opportunities
Requests to keep the relationship or financial discussions private

Defensive mindset

Trust must be verifiable, not emotional. Relationships formed online (especially those involving money, investments, or sensitive information) should always be validated through independent verification, not feelings or perceived intimacy.

Use case

A professional connects with a “consultant” on LinkedIn who regularly shares industry insights. After weeks of daily conversation, the attacker introduces a crypto trading platform they claim to use successfully. The victim is shown fake dashboards and small initial “returns,” encouraging larger investments. Once funds are transferred, withdrawal attempts fail and the attacker disappears.

Analyst lens / takeaway

These scams are long-term and multi-stage. Indicators include cross-platform migration, repeated investment narratives, and financial requests following emotional bonding. Detection requires behavioural timelines, not single-message analysis.

2.3 - Tech Support Scams

What it is

Attackers impersonate legitimate technology companies (such as Microsoft, Apple, or antivirus vendors) and claim that the victim’s device or account is compromised. The scam typically starts with a browser pop-up, email, SMS, or phone call urging the victim to contact “technical support,” where attackers attempt to gain remote access, steal credentials, or extort money [3].

Why it works

Use of well-known brands and official-looking logos
Fear of system compromise or data loss
Urgent language that pressures victims to act immediately
Attackers sound knowledgeable and authoritative, sometimes using scripts or AI-generated voices

Red flags

Unsolicited pop-ups or calls claiming your device is infected
Requests to install remote access software
Demands for immediate payment to “fix” an issue
Claims that only the caller can resolve the problem

Defensive mindset
Legitimate tech companies do not initiate support through unsolicited alerts or calls. Verification and independent contact are essential before taking any action.

Use case

A user encounters a full-screen browser pop-up claiming their system is infected and instructing them to call “Microsoft Support.” The caller guides the victim to install remote access software, displays fake error logs, and demands payment to “secure” the device.

Analyst lens / takeaway

Watch for remote access tool installation following browser alerts, payment requests tied to fake diagnostics and scare-based escalation scripts. These attacks often leave behind persistent access.

2.4 - Hiring and Recruitment Scam

What it is
Attackers impersonate recruiters, HR representatives, or well-known companies to offer fake job opportunities. These scams often begin on professional platforms such as LinkedIn or via email and progress toward requests for personal data, credentials, payments, or task-based “assessments” that install malicious programs (malware) on your computer [4].

Why it works

Professional context lowers suspicion
Job pressure and career ambition impair critical judgment
Use of real company names, logos, and employee profiles increases credibility
Gradual escalation from informal conversation to “official” hiring steps (professional illusion)

Red flags

Job offers without formal interviews
Requests for fees, equipment purchases, or upfront payments
Communication from personal email accounts instead of corporate domains
Pressure to act quickly or keep the opportunity confidential

Defensive mindset
Legitimate hiring processes are verifiable, structured, and never require secrecy or upfront payments.

Use case

A recent graduate is contacted on LinkedIn by a recruiter claiming to represent a well-known company. After brief conversations, the victim is sent a “technical assessment” as a downloadable file. Opening the file installs malicious programs on your computer, that steals browser credentials and crypto wallet data.

Analyst lens / takeaway

Red flags include job offers without interviews, malware disguised as assessments, and non-corporate communication channels. Early-career professionals are high-value targets due to urgency and ambition.

2.5 Typosquatting

What it is
Attackers register domains that closely resemble legitimate websites (e.g., micros0ft.com using 0 (zero) instead of o, or paypaI.com, using a capital i instead of a lowercase l) to trick users into visiting them [5]. These sites are then used to steal credentials, deliver malware, or conduct phishing attacks.

Why it works

Users visually assume the domain is legitimate
Small typographical differences are easily overlooked
Phishing pages and malware downloads mimic trusted sites

Red flags

Slight misspellings or unusual characters in URLs
Unexpected login prompts on familiar websites
Browser warnings about invalid certificates
Suspicious requests for credentials or sensitive information

Defensive mindset
Always verify URLs carefully, and for critical services, use manually typed URLs or trusted bookmarks. Where possible, use DNS filtering and browser protections to reduce exposure.

Use case

A user clicks a link to what appears to be a legitimate payroll portal. The URL differs by a single character from the real domain. For instance, they might swap a capital i ("I") for a "l," turning google[.]com into googIe[.]com. The site perfectly mirrors the login page and silently captures credentials before redirecting to the legitimate site, leaving the victim unaware.

Analyst lens / takeaway

Typosquatting often involves pixel-perfect clones and credential harvesting with redirection. Domain monitoring and DNS telemetry are critical; user awareness alone is insufficient.

2.6 - Evil Twin Wi-Fi Attacks

What it is
An Evil Twin Wi‑Fi attack occurs when an attacker sets up a rogue wireless access point (WiFi) that impersonates a legitimate network (e.g. “Free Airport Wi‑Fi” or “Hotel_Guest”). Victims unknowingly connect to the fake network, allowing the attacker to intercept traffic, steal credentials, or inject malicious content [6].

Why it works

Users instinctively trust familiar network names
Public Wi‑Fi environments reduce caution
Devices often auto‑connect to known SSIDs
The attack requires no direct interaction with the victim

Red flags

Multiple networks with similar or identical names
No password required where one is normally expected
Frequent connection drops or certificate warnings
Login pages that appear unexpectedly

Defensive mindset
Disable auto-connect and use a Virtual Private Network (VPN). Certificates or duplicate network names are immediate warning signs. A VPN creates a secure connection between your device (computer, phone, etc.) and the internet. Think of it as a private tunnel through the public internet.

Use case

At an airport, a traveler connects to “Free_Airport_WiFi,” unaware it is a rogue access point. Traffic is intercepted, and a fake captive portal captures email credentials. The attacker later uses these credentials to access cloud services.

Analyst lens / takeaway

Indicators include unencrypted traffic, unexpected captive portals, and credential reuse following travel events. Public WiFi environments are ideal for passive credential harvesting.

2.7 - Virtual Kidnapping Scams

What it is
Attackers contact victims claiming that a loved one has been kidnapped. They often use leaked personal information, spoofed phone numbers, or AI-generated voices and videos to create the illusion of a real threat. The attackers then demand immediate ransom payments, often in cryptocurrency, to secure the “release” of the victim’s family member or friend [7].

Why it works

Panic and fear override logical thinking
Urgency pressures victims to act without verification
Personalized details and AI-enhanced media increase credibility

Red flags

Immediate demand for payment or action
Threats that escalate if not followed quickly
Refusal to allow verification or contact with authorities

Defensive mindset
Verify before acting; panic is the attacker’s weapon. Contact authorities or the supposed victim directly.

Use case

A victim receives a call claiming their child has been kidnapped. The caller uses personal details sourced from social media and plays an AI-generated voice crying for help. The victim is pressured to send cryptocurrency immediately to prevent harm.

Analyst lens / takeaway

These attacks rely on panic over persistence. Look for time-boxed ransom demands, refusal of verification, and use of AI-generated media. Slowing the interaction is often enough to disrupt the attack.

2.8 Physical Letter Scams

What it is
Attackers send official-looking letters or postal mail containing fraudulent requests, QR codes, or payment instructions. These letters often appear to come from banks, government agencies, or reputable companies, tricking recipients into taking immediate action [8].

Why it works

Physical mail is perceived as more trustworthy than email
Official branding, logos, and letterhead increase credibility
Scarcity and urgency in the content pressure recipients to act quickly

Red flags

Unexpected letters from “official” sources requesting sensitive information or payment
Urgent deadlines that bypass normal verification procedures
Requests to scan QR codes or visit unusual websites
Instructions to keep the communication private

Defensive mindset
Treat all physical letters with healthy skepticism and beware of QR code scans. Verify independently through official channels before taking action. Trust must be verifiable, not assumed based on appearance.

Use case

A victim receives an official-looking letter claiming to be from a bank, warning of account suspension unless action is taken. The letter includes a QR code leading to a phishing site that collects credentials and personal information.

Analyst lens / takeaway

Physical delivery increases trust. QR-based phishing bypasses email security controls entirely, shifting detection to user behaviour and domain intelligence.

2.9 - Podcast, YouTube and Collaboration Scams

What it is

Attackers impersonate podcast hosts, YouTubers, media agencies, or well-known brands and approach victims with collaboration, interview, or sponsorship offers. Communication often starts via email or social media and includes malicious links, fake contracts, or malware-laden attachments disguised as media kits or agreements [9].

Why it works

Professional context lowers suspicion
Desire for visibility, credibility, and career growth
Personalised outreach using publicly available information
AI-generated emails, documents, and branding increase realism

Red flags

Requests to download contracts, briefs, or “media kits” from unknown links
Pressure to act quickly to “secure the slot” or collaboration
Use of free email domains or slightly altered brand names
Requests to disable security controls or open files outside official platforms

Defensive mindset
Verify opportunities through official channels; never download from unverified sources.

Use case

A content creator receives an email from a “media agency” offering a podcast appearance. The email includes a link to download a contract or media kit. Opening the file installs malware designed to hijack social media and email accounts.

Analyst lens / takeaway

Threat actors exploit visibility and reputation incentives. Indicators include malicious document delivery, brand impersonation, and account takeovers used for further outreach.

Cross Cutting Insight
Most social engineering attacks are not isolated events. They are process-driven, repeatable, and scalable operations. Detection improves dramatically when defenders analyse behavioural patterns over time, not single messages or incidents.

3) Preventing Social Engineering: A Defender's Framework

An effective defence against social engineering attacks requires a holistic framework that integrates People, Technology, and Process, recognising that such attacks exploit human behaviour as much as technical vulnerabilities.

From a people perspective, continuous security awareness training, realistic phishing simulations, and a culture that encourages questioning and reporting suspicious activity empower individuals to act as the first line of defence:

Continuous awareness training focused on why attacks succeed.
Encourage reporting without blame to build open communication.

On the technology side, advanced email filtering, behavioural analytics, identity and access management, and AI-driven anomaly detection reduce exposure and provide early warning of social engineering attempts:

Multi-factor authentication everywhere: MFA requires two or more forms of verification before granting access.
- Tools: Google Authenticator / Microsoft Authenticator.
Email authentication (DMARC, DKIM, SPF): These are protocols that verify if emails really come from the sender they claim.
- Tools: Google Workspace / Microsoft 365.
DNS security and filtering: Blocks access to malicious domains automatically.
- Tools: Cisco Umbrella, Cloudflare Gateway (Zero Trust DNS).
Endpoint detection and response (EDR): EDR tools monitor devices (endpoints) in real time to detect suspicious activity, investigate, and respond.
- Tools: Microsoft Defender for Endpoint, SentinelOne, Sophos Intercept X.
Zero-trust assumptions: Zero-trust is a security philosophy: “Never trust, always verify.”
- Tools: Google BeyondCorp, Zscaler Zero Trust Exchange.

These capabilities must be reinforced by robust processes, including clear incident response procedures, verification protocols for sensitive requests, and regular audits to ensure compliance and effectiveness:

Mandatory verification for sensitive requests.
Multi-person or multi-channel approval for payments or access changes.

When aligned, these three pillars create a resilient socio-technical defence: people are informed and vigilant, technology provides scalable protection and visibility, and processes ensure consistency, accountability, and rapid recovery. This integrated approach significantly reduces the likelihood and impact of social engineering attacks, transforming security from a purely technical challenge into an organisational capability.

In conclusion, social engineering does not succeed because people are careless. It succeeds because they are human. As cyber professionals, our responsibility is not only to secure systems, but to design environments where human mistakes do not become catastrophic breaches. Attackers will continue to evolve. AI will amplify deception. But strong verification, resilient processes, and informed users remain powerful countermeasures. In cybersecurity, the most secure system in the world is useless if the human behind it is left unprotected.