Social engineering is the art of getting a person to do the attacker’s work for them: read out a code, approve a login, change a bank account or install a remote access tool. It works because it skips the firewall and goes straight to people who want to be helpful. In the FBI’s 2025 Internet Crime Report, phishing and spoofing was the most reported crime with 191,561 complaints, and business email compromise caused more than $3 billion in losses.
This guide gives employees and managers a repeatable process for spotting a social engineering attempt, verifying it safely and reporting it, plus the controls that stop the most damaging versions.
Before you start
Find 3 things now, before you need them: your company’s phishing report button or address, the IT help desk’s official phone number and the name of the person who approves payment changes. Save them somewhere you can reach without opening a suspicious email.
Step 1: Learn the pretexts attackers use
Most attempts follow a few scripts. Recognizing the script is faster than judging every detail.
- Fake IT or help desk: “We see a problem with your account. Read me the code we just sent.” Scattered Spider used this script against large companies, per CISA advisory AA23-320A.
- Fake executive: an urgent email or text from the CEO asking for gift cards, a wire or a confidential file.
- Fake vendor: “We changed banks. Please send future payments to this account.”
- Fake login page: a shared document, voicemail or invoice link that opens a Microsoft 365 or Google sign-in page.
- Fake fix: a web page with a “verify you are human” box that tells you to paste a command into the Windows Run box or Terminal. Microsoft calls this ClickFix.
- Insider recruitment: an offer of money to share access or record internal screens, as seen in the Kraken support staff case.
What success looks like: when a request arrives, you can name which script it matches.
Step 2: Check for the warning signs
CISA’s phishing guidance lists urgent or emotional language, requests for personal or financial information, and sender addresses or links that do not match the real company. Do not rely on typos. AI tools now write clean, convincing messages and can clone a voice from a short clip, which is how attackers ran the AI-powered attack on Zerion.
Stronger signals are about the request itself: a new channel, a new payment destination, secrecy, a deadline measured in minutes or a request to bypass a normal process.
What success looks like: you pause on any message that asks for money, credentials, codes or remote access, no matter how polished it looks.
Step 3: Verify through a channel you already trust
Do not reply, click or call back using anything in the message. Hang up and call the person or company at a number from your own contacts, the company directory or the back of your card. For an internal request, message the person directly in your company chat app or walk to their desk.
Never read a one-time code or approve an MFA prompt for someone who contacted you. Real IT staff do not need your code.
What success looks like: the request was confirmed or denied by someone you reached on your own.
Step 4: Lock down payment and bank changes
Business email compromise succeeds when 1 person can change where money goes. Set these rules in writing:
- Every new payee or bank account change requires a callback to a number already on file, never one in the request.
- Payments above a set amount need a second approver.
- Gift card and crypto requests from executives are always treated as fraud until confirmed in person or by phone.
What success looks like: no payment detail can change based on an email alone.
Step 5: Harden the help desk
CISA reports that Scattered Spider posed as employees to get help desks to reset passwords and move MFA to devices the attackers controlled. Help desks should verify identity before any reset, for example with a callback to the number in the HR system, a video check against the employee photo or approval from the person’s manager. Log every MFA reset and alert the user by a second channel when one happens.
What success looks like: a caller who only knows an employee’s name, title and employee ID cannot get a password or MFA reset.
Step 6: Report it the right way
- Outlook: select the message, then select Report on the Home tab, then Report phishing, if your organization enabled it, per Microsoft.
- Gmail: open the message, click More next to Reply, then Report phishing, per Google.
- Phone and text: tell your security team with the number, time and what was asked.
- Money lost: call your bank right away to try to recall the transfer, then file at ic3.gov. Consumers can also report at reportfraud.ftc.gov.
If you clicked a link, entered a password or approved a prompt, report that too. Fast reporting lets IT reset the account and end sessions before the attacker moves on.
What success looks like: security knows within minutes, and nobody is afraid to admit a mistake.
Step 7: Switch to phishing-resistant MFA
Text codes and push approvals can be phished, SIM swapped or worn down with repeated prompts, a trick called MFA fatigue. CISA recommends phishing-resistant MFA such as FIDO2 security keys or passkeys, which only work on the real website. Start with admins, help desk staff and finance.
What success looks like: a stolen password plus a convincing phone call is no longer enough to sign in.
Step 8: Train with realistic drills
Run short, frequent sessions built on real incidents, such as the Levi Strauss and Five Below attacks. Include phone and text scenarios, not only email. Measure how many people report a test, not just how many click.
What success looks like: reporting rates rise each quarter and staff can describe the callback rule without looking it up.
Common mistakes
- Calling the number in the message. It goes to the attacker.
- Trusting caller ID or a familiar voice. Both can be faked.
- Shaming people who click. They stop reporting, and you lose your early warning.
- Training only on email. Many recent attacks started with a phone call to the help desk.
- Leaving SMS as the only MFA for admins. It is the first thing attackers target.
Related reading
- Ransomware: What to Do in the First 24 Hours
- How to Check If an Infostealer Stole Your Passwords and What to Do
- Court Documents Reveal How Microsoft Helped Identify Alleged Scattered Spider Member
- Exposed Phishing Infrastructure Reveals Three Active Microsoft 365 Campaigns
Last verified: November 1, 2026
