Social Engineering Beyond Email

Email phishing gets most of the attention in security awareness programs, and email filtering has improved as a result. Attackers have adapted. Many now skip the inbox and go straight to people: a phone call to the help desk, a text message about a package or a payroll change, a message in a collaboration app, or a confident visitor holding a box at a badge-controlled door.

These approaches work because they target trust and helpfulness rather than technology. Defending against them depends on procedures that do not rely on staff judging whether someone sounds legitimate.

Voice phishing

Vishing calls impersonate IT support, executives, vendors, banks or government agencies. Common patterns include:

• Fake IT support calling an employee to "fix" a problem, then asking them to approve an MFA prompt, read out a code or install remote access software.
• Executive impersonation requesting an urgent payment, gift cards or a sensitive document.
• Vendor impersonation asking to change bank account details for future invoices.

Caller ID can be spoofed, and attackers often research names, titles and internal terminology in advance. Voice cloning tools make impersonating a specific person more convincing, so a familiar-sounding voice is not proof of identity.

Text and messaging attacks

Smishing uses SMS and messaging apps, where people tend to be less cautious and links are harder to inspect. Messages often impersonate delivery services, payroll or benefits providers, or the organization's own IT team. Attackers also use collaboration platforms that allow messages from external accounts, posing as help desk staff in a chat. Restricting external messaging to known partner domains reduces this exposure.

Help-desk impersonation and MFA resets

The help desk is one of the most targeted functions in the organization. An attacker who calls pretending to be an employee, and who persuades an agent to reset a password or register a new MFA device, gains access without phishing anyone. CISA and other agencies have warned about this technique in campaigns against large organizations.

Protect the help desk with procedures, not instinct:

• Verify through a separate channel. Call the employee back on a number from the HR directory, not one the caller provides.
• Require manager or second-party approval for MFA resets and new device registrations, especially for privileged accounts.
• Avoid knowledge-based questions whose answers can be found online or in breached data.
• Use identity verification tools where available, such as in-person or video verification with an ID check for high-risk resets.
• Alert on sensitive changes, such as new MFA methods on administrator accounts, and notify the account owner.

Phishing-resistant MFA also helps: an attacker cannot talk a user into reading out a code that does not exist.

In-person social engineering

Physical intrusion often relies on social norms. People hold doors for someone carrying boxes, avoid challenging a person in a hard hat or a vendor uniform, and assume anyone inside the building belongs there. Common techniques include tailgating through secured doors, posing as contractors or inspectors, and leaving USB devices in parking lots or common areas.

Countermeasures include visible badges for everyone, escort requirements for visitors, turnstiles or mantraps for sensitive areas, and a clear expectation that staff may politely challenge anyone they do not recognize and direct them to reception or security.

Build verification into everyday work

The most effective defense is a set of simple rules that apply regardless of who is asking:

• Payment and bank detail changes are always confirmed through a known contact, never through the channel the request arrived on.
• IT staff never ask for passwords or MFA codes.
• Urgency and secrecy are reasons to slow down and verify, not to skip steps.
• Reporting a suspicious call or text is encouraged and never punished, even if the employee already responded.

Leaders should follow these rules visibly. Staff are far more likely to challenge a request that claims to come from an executive when they know executives expect to be verified.

Test and train

Include phone, text and physical scenarios in security awareness training, not just email. Authorized social engineering assessments show how your help desk and front desk actually respond under pressure, and the results point directly to the procedures that need strengthening.

How CDT can help

CDT conducts authorized vishing, smishing and physical social engineering assessments and turns the results into practical procedures and training for the staff who are most likely to be targeted.