# What is Social engineering?

> Manipulating a person into granting access, rather than defeating a technical control.

Last reviewed: 2026-09-01

## Social engineering

Category: Attacks

Canonical page: https://moolkey.com/glossary/social-engineering

Social engineering attacks the person rather than the system. It includes phishing emails, pretext phone calls, fake support agents, and SIM swapping. In each case, the attacker uses persuasion to route around a technical control and convince someone to grant access.

### Why it works on careful people

Effective social engineering manufactures urgency and authority, such as a message that appears to come from your bank and says your account will be frozen within the hour. Under time pressure, people stop verifying. The defence is procedural: never act on an inbound message. Start contact yourself through a number or address you already had.

### The controls that still hold

Security keys resist phishing because origin binding prevents a fake site from receiving a usable credential. Codes, passwords, and one-time links can still be relayed by an attacker talking to you in real time.

### Sources

- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [W3C: Web Authentication: Level 3](https://www.w3.org/TR/webauthn-3/): The web standard behind passkeys and FIDO2 security keys.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.