Social Engineering
In short
Social engineering describes attacks that do not defeat the technology but the people in front of it. The attacker manufactures trust, time pressure or authority and gets someone to hand something over or carry something out voluntarily: a password, a payment, an approval. The firewall stays untouched throughout – it was never the target.
The patterns that work in a business day
The boss who is currently on a plane. An email supposedly from management demands an urgent payment and asks to skip the usual route just this once. Time pressure plus authority plus a request for discretion – that is the complete recipe.
The changed account number. A familiar supplier invoice arrives again, with a new IBAN and a note about a change of bank. It surfaces when the real supplier sends a reminder.
The helpful support desk. A call offering to help with setup that asks for the confirmation code which has just arrived on the phone.
Why technology alone does not cover it
Because nothing happens that a filter could recognise. An email with no attachment, no link and correct grammar is technically unremarkable – it contains only a request.
Two-factor authentication does not help either when someone reads the second factor out over the phone. It moves the target from the password to the person, which is exactly where social engineering already works.
What actually helps in Switzerland
A four-eyes rule on payments that admits no exception. The attack works through the exception, not the rule. A rule with an emergency clause is precisely the gap being looked for.
Call back on the known number, never the one given in the message. It costs two minutes and closes the most common variant completely.
In Switzerland, suspected and actual incidents are received by the Federal Office for Cybersecurity. Reporting is worthwhile even when nothing happened – those reports are the data the national picture is built from.
How we handle it
We treat it as a process question, not a training question. A workflow that holds under time pressure is more reliable than any awareness campaign – people stay tired and in a hurry.
Technically it is backed by IT security and a modern workplace where identity and device are checked together.
Related terms
A term in your quote that nobody explained?
In a strategy call we translate the offer in front of you – even when it did not come from us.