Social Engineering: What Employers Need to Know

Social engineering is manipulating a person into taking an action or revealing information, rather than defeating a technical control. For employers it is the mechanism behind nearly every fraud that reaches HR and payroll, because those functions can be asked to do things that no system would permit an outsider to do directly.

An attacker cannot change an employee's bank account from outside. But they can ask someone who can.

The levers

The techniques are consistent and worth naming, because recognizing the lever is easier than evaluating each message.

Authority. A request appearing to come from an executive. The recipient weighs the cost of being wrong about a fraud against the cost of appearing to distrust the CFO, and the second feels more immediate.

Urgency. A deadline that removes time to think or verify. Almost every successful scheme includes one, because verification is what defeats them.

Helpfulness. The most underestimated. HR teams are measured on being responsive to employees. "I switched banks and need this updated before Friday" is exactly the request a good HR professional wants to resolve quickly.

Familiarity. References to real projects, real colleagues, real invoices — gathered from a compromised mailbox or public sources. This is what makes modern attempts feel legitimate.

Fear. A threatened consequence: an account closing, a payment failing, a compliance problem.

Why the workforce is the target

Attacking people is cheaper and more reliable than attacking systems. It requires no technical skill, leaves little for security tools to detect, and scales — the same pretext works across hundreds of employers with minor edits.

It also targets the least-defended surface. Employers invest in endpoint protection and firewalls, then leave the process for changing an employee's bank details as an email to a single person with no verification step.

The forms employers actually see

• Pretexting — a fabricated scenario, often impersonating IT support, a benefits administrator, or a vendor
• Phishing, vishing, smishing — the same manipulation by email, phone, or text
• Executive impersonation — authority plus urgency, aimed at finance and HR
• Employee impersonation — the payroll diversion scheme
• Tailgating — physical entry by following an employee through a controlled door, which works because stopping someone feels rude
• Information gathering — harmless-seeming calls establishing who handles payroll, when it runs, and who is on vacation

That last one is worth flagging. A call asking innocuous organizational questions is often reconnaissance for a later attempt, and employees have no reason to treat it as suspicious.

Why training alone is insufficient

Training raises the bar and is worth doing. But social engineering is engineered against reasonable people, and the best version — a request from a genuinely compromised colleague's account, referencing real context — is not reliably detectable by anyone.

Treating awareness as the whole defense puts the entire burden on an employee's judgment in a moment designed to compromise it. The organization needs controls that work when judgment fails.

Controls that do not depend on detection

• Out-of-band verification for banking changes and bulk data requests, using contact details already on file
• Two-person approval for payments and banking changes, so one manipulated employee cannot complete the action
• Waiting periods, which remove urgency as a usable lever
• Defined channels, so out-of-process requests are visibly abnormal
• Restricted authority, limiting how many people can be targeted at all

Each of these works regardless of whether the employee recognized anything.

Removing the social pressure

The most effective non-technical measure is leadership stating explicitly that verification is expected, applies to requests appearing to come from them, and carries no consequence for the employee who checks.

Authority-based manipulation only works while employees believe pushing back is career-risky. Saying otherwise, publicly and more than once, closes the most damaging variant at no cost.

The same applies to reporting. An employee who realizes they were manipulated needs to be able to say so within minutes, without fear. Organizations that treat these as personal failures learn about incidents last.

Employer's Guardian helps employers train staff against the specific pretexts aimed at HR and payroll, and document that training, through workforce training.

This article provides general educational information, not legal, tax, or insurance advice. Requirements vary by location, industry, and the data your organization handles.