What Social engineering means
Attackers call help desks, pose as vendors or create urgency to get someone to bypass normal steps. Clear procedures and a culture where staff can say "let me verify" are the best defense. Technology alone does not solve it.
Why it matters for your website
Many breaches start with a person being tricked, not a system being cracked. One convincing call or email can hand over your website login, domain account or bank details, so staff awareness is one of the best defenses you have.
Example
Someone calls a dental office pretending to be from the web host and asks the receptionist to read back a verification code, which lets them take over the hosting account.
Tips
- Verify unusual requests by calling back on a number you already have.
- Teach staff that real vendors will not ask for passwords or login codes.
- Create a simple rule: money or access changes need a second person's approval.
Common mistakes
- Assuming only careless people fall for these tricks.
- Posting staff names, roles and email formats in ways that make targeting easy.
Questions about Social engineering
What is Social engineering?
Manipulating people, rather than hacking systems, to gain access or information.
What are common types of social engineering?
Common types include phishing emails, phone scams (vishing), text scams (smishing), pretexting with a made-up story, and baiting with infected files or devices.
How do I train employees to spot social engineering?
Use short, regular training with real-looking examples and make it easy to report anything suspicious. Praise people who report, even if it turns out to be harmless.
