Social engineering: The use of deception and psychological manipulation to persuade people to reveal confidential information, grant access or take actions that benefit an attacker.
Also known as: Human hacking, Pretexting, Impersonation attack
Key takeaways
- Social engineering targets human behavior, not software flaws.
- It leans on six levers: authority, urgency, helpfulness, fear, familiarity and reciprocity.
- Phishing and smishing are delivery methods; pretexting and impersonation are the techniques.
- The strongest defense is a habit: verify unusual requests through a second, known channel.
- In C Chat, team membership, @usernames and block and report make impostors easier to spot and stop.
Most security tools defend computers. Social engineering skips them entirely and goes after the person using the computer. For teams with many frontline staff, contractors and clients in the same chats, understanding this kind of attack is as important as choosing a secure messenger.
Social engineering: a plain definition
Social engineering is getting someone to do the attacker’s work for them. Instead of breaking into an account, the attacker persuades a legitimate user to open the door: share a code, approve a payment, send a file or add a stranger to a group.
It is an umbrella term. Phishing by email and smishing by text are the most common delivery channels, but phone calls, chat messages and in-person visits are just as effective.
How it works
Social engineers rely on predictable human reactions. Recognizing the lever often breaks the spell:
| Lever | What it sounds like |
|---|---|
| Authority | “This is the director. I need it now.” |
| Urgency | “The account closes in an hour.” |
| Helpfulness | “Can you do me a quick favor? I’m locked out.” |
| Fear | “There is a problem with your payroll.” |
| Familiarity | A known name, photo or inside detail from social media |
| Reciprocity | “I fixed your issue, can you just confirm the code?” |
A typical attack collects small details first, such as names, roles and schedules, then combines them into one convincing request.
Why it matters for business messaging
Team chats are full of the details attackers want: who is in charge, who is on shift, which supplier is due, what a client’s site is called. They are also where people respond fastest. A message in a familiar group, from a familiar name, gets less scrutiny than a cold email.
Typical chat scenarios include an impostor account copying a supervisor’s name and photo, a former contractor who still has access asking for “updated” information, and a message asking someone to forward the code that just arrived. That last request often leads to an account takeover, or supports a SIM swap attempt with the mobile carrier.
How it relates to C Chat
No messenger can stop a determined manipulator, but some design choices make impersonation harder and cleanup faster. In C Chat:
- Membership is controlled. Colleagues belong to your team, managed by owners and admins, and guests join specific groups by invitation. A random account claiming to be your boss is not in your team.
- Identity cues are visible. People have a name, photo and optional @username. Check the @username, not just the display name.
- Impostors can be stopped. Use block and report; reported messages may be reviewed for moderation, and that access is logged.
- Former staff can be removed. Taking someone out of the team removes them from its groups, closing a common source of insider-style pretexting.
- There is no password to trick out of you, but the sign-in code must never be shared.
For training material, use how to spot phishing in chat apps and mobile security basics for staff phones.
Related terms and common misconceptions
- “It only works on non-technical people.” Attackers routinely fool IT staff and executives with well-researched pretexts.
- “Training once is enough.” Tactics change; short, regular reminders work better than an annual course.
- “It is always online.” Tailgating through a door or calling the front desk are classic offline forms.
Getting started
Move work conversations into a space where you know who is in each group and can remove people instantly: create a team at getcchat.com/c. Learn more about protections on the security page.
Frequently asked questions
What are examples of social engineering?
A caller posing as IT support asking for a login code; a text from "your manager" on a new number requesting gift cards; a person in a uniform asking to be let into a building; a fake supplier emailing new bank details; and a chat message from a lookalike account asking for confidential files.
What is pretexting?
Pretexting is building a believable story, the pretext, to justify a request. For example, an attacker claims to be an auditor who needs a staff list, or a new colleague who lost access. The story lowers suspicion so the target hands over information.
How do you defend a team against social engineering?
Set clear rules that remove judgment calls: nobody shares sign-in codes, payment changes are always confirmed by phone, and unexpected requests are checked with the person through a known channel. Practice with real examples and make reporting easy and blame-free.
Can technology stop social engineering?
Only partly. Filters, sign-in protections and clear identities reduce exposure, but a convincing message can still persuade a person. Process and awareness do most of the work.