Social Engineering Attack

What Is a Social Engineering Attack?

Breaking strong encryption can take longer than the age of the universe. Asking someone for their password takes one phone call. Social engineering is the name for attacks that choose the second route: they target the person who controls a system rather than the system itself.

The phrase once described government efforts to shape society, and hacker Kevin Mitnick made it famous in the 1990s by showing how much he could obtain from phone companies simply by sounding like an employee. The methods have not changed much since then. What changed is the prize: in crypto, one leaked seed phrase can give an attacker irreversible control of an entire wallet.

Most attacks lean on a small set of psychological levers that the psychologist Robert Cialdini described in 1984: authority, urgency, scarcity, social proof, liking and reciprocity. An email from “the security team” uses authority. A message saying your account closes in 30 minutes uses urgency. Recognising the lever is often the fastest way to recognise the attack.

How Does a Social Engineering Attack Work?

Once you know the levers, the structure of almost every attack becomes predictable. It runs in four stages: research, contact, manipulation and exit. The attacker first gathers details about the target from social media, leaked databases or public posts, then opens contact with a believable story, called a pretext. The pretext creates pressure to act quickly, and the attacker disappears as soon as the money or access is secured.

Here is how that looks in crypto. A trader posts publicly that a withdrawal from their exchange account is stuck. Within minutes, a direct message arrives from an account using the exchange’s logo, offering help and apologising for the delay. The “agent” asks the trader to connect their wallet to a “verification page” and enter the 12-word recovery phrase to “sync” the account.

Every step exploits a lever. The public complaint gave the attacker a target and a story; the logo supplied authority; the apology built liking; the stuck withdrawal created urgency. If the trader types in the phrase, a script sweeps the wallet within seconds, and a balance of 2 ETH plus a few thousand dollars in stablecoins moves to the attacker in one block, with no bank or chargeback to reverse it.

Large companies fall for the same pattern. In September 2023, attackers reportedly found an MGM Resorts employee on LinkedIn, called the IT help desk while posing as that person and obtained access that led to a ransomware incident. MGM later estimated a roughly $100 million hit to its quarterly results.

Types of Social Engineering Attacks

Phishing uses fake emails, websites or messages to collect login details or wallet approvals, and it is the most common form.

Vishing and smishing move the same trick to phone calls and SMS, often combined with caller-ID spoofing so the call appears to come from a bank or exchange.

Pretexting builds a detailed false identity, such as a new colleague, auditor or recruiter, to justify an unusual request.

Baiting and insider bribery tempt the target with something valuable: a free token, an infected USB drive or cash paid to a support employee in exchange for customer data.

Relationship scams, often called pig butchering, build trust over weeks through friendship or romance before steering the victim to a fake investment platform.

Social Engineering Attack vs. Phishing Attack

Every phishing attack is social engineering, but not every social engineering attack is phishing. A help-desk call or a months-long romance scam uses no fake website at all.

Why Is a Social Engineering Attack Important for Traders?

Crypto removes the safety nets that limit social engineering in traditional finance. A bank can freeze a fraudulent wire transfer, but a blockchain transaction signed with the right key is final. That finality is why attackers target traders so heavily, and why the largest loss category in the FBI’s 2023 Internet Crime Report was investment fraud, most of it involving cryptocurrency.

Technical defences help, but none is complete. 2FA blocks password theft, yet a caller can still talk a victim into reading out the code. A hardware wallet protects keys from malware, yet it will still sign a malicious transaction the owner approves. The weak point is the decision, not the device.

The most reliable defence is a set of fixed rules that no story can override. Never share a seed phrase, never let a stranger control your screen, and contact any company only through the address you already know. An attacker can fake urgency and authority, but not your own habit of hanging up and calling back.

Key Takeaways

• A social engineering attack manipulates a person into handing over access, information or money, rather than breaking the technology itself.
• Attacks follow a pattern of research, a believable pretext, psychological pressure and a quick exit once the goal is reached.
• The main levers are authority, urgency, scarcity, social proof, liking and reciprocity, and spotting them is the fastest warning sign.
• Phishing is only one form of social engineering; phone scams, pretexting, bribery and long-running relationship scams belong to the same family.
• Because blockchain transactions cannot be reversed, fixed personal rules, such as never sharing a seed phrase, matter more than any single security tool.