Social Engineering Awareness Training
A short, practical training to help employees spot manipulation, fake urgency, impersonation, and “please ignore the normal process” scams before they turn into a company-wide cleanup project.
Start Here: The Scam Is Usually Not Fancy
You get a message that looks like it came from your boss.
They are in a meeting. They need help fast. They ask you to buy gift cards, approve an invoice, send a file, reset a password, or share information “just this once.”
It does not look like a hacker movie. Nobody is wearing a hoodie in a dark basement while green code falls from the ceiling.
It looks like work.
That is why social engineering works. It attacks people, pressure, trust, and timing — not just computers.
What Is Social Engineering?
Social engineering is when someone manipulates a person into doing something unsafe.
Instead of hacking through a firewall, they try to hack normal human behavior.
“I need this right now.” “Your account will close.” “Final warning.” The goal is to make you rush.
They may impersonate a boss, vendor, coworker, IT support, payroll, HR, or a delivery service.
They want you to skip normal approvals, payments, ticketing, or verification steps. Convenient for them. Bad for everyone else.
They may imply you did something wrong, missed a deadline, or need to fix a problem quietly.
Common Social Engineering Tricks
These are the ones employees are most likely to run into during a normal workday.
A manager supposedly needs gift cards, a wire transfer, or a quick favor while “in a meeting.”
Someone claims your account has a problem and asks for your password, MFA code, or remote access.
An attacker sends a realistic invoice or asks to update payment details.
A message asks you to review benefits, update tax info, or confirm direct deposit details.
Someone follows an employee into a secure area because holding the door feels polite. Scammers love politeness when it opens locked doors.
A random USB drive is left where someone might plug it in. Curiosity is not a security control.
What To Do Instead
You do not need to solve the whole mystery yourself. You just need to avoid making the risky move.
- Pause before responding. Urgency is a tactic. Give yourself a minute.
- Verify through a known channel. Use a trusted phone number, company chat, ticketing system, or official website.
- Do not use contact details inside the suspicious message. That may lead straight back to the scammer.
- Do not share passwords or MFA codes. Real IT should not need them.
- Do not approve surprise MFA prompts. If you did not try to sign in, do not approve it.
- Do not bypass normal process. If someone wants you to skip approvals, that is the point where your eyebrows should get involved.
- Report suspicious requests. Use the official company method.
If You Already Responded or Clicked
Do not panic. Do not hide it. Fast reporting gives the security team a chance to limit the damage.
- If you clicked a suspicious link: close the page and report it.
- If you entered your password: change it from a trusted device and notify IT immediately.
- If you approved an MFA prompt you did not request: report it immediately.
- If you opened an attachment: stop using the device and contact IT.
- If you shared payment, payroll, customer, or company information: report it right away.
- If someone got into a secure area: notify security or your supervisor using the approved process.
Quick Social Engineering Checklist
- Is the request urgent, emotional, or pressuring you to act fast?
- Is the person asking you to skip normal process?
- Are they requesting passwords, MFA codes, payments, payroll changes, or private data?
- Did the message come through an unusual channel?
- Does the sender address, phone number, or link look slightly off?
- Would you verify this differently if money, access, or customer data were involved?
- Can you confirm it through a known, trusted method?
Quick Social Engineering Quiz
Choose the safest response for each workplace scenario. The goal is not to memorize scam words. The goal is to slow down, verify, and report before acting.
Quiz Complete
The Takeaway
Social engineering works because people are busy, helpful, distracted, and trying to get through the day.
That does not make employees the problem. It means the system needs a pause button.
When a request involves money, access, passwords, MFA codes, payroll, customer data, or skipping normal process: stop, verify through a trusted channel, and report anything suspicious.
Leave a Reply