Hacking the human

The cheapest way in

Organisations spend heavily on firewalls, updates and antivirus. Attackers noticed something much cheaper: it is easier to ask a person for the key than to pick the lock. That is social engineering, and it is the subject of this whole module. It targets the human, not the machine.

This first lesson explains what the trick is and why it works on almost everyone. The lessons that follow show its common shapes so you can spot them coming.

Hacking people, not computers

Social engineering is the art of talking someone into handing over information or doing something they should not: revealing a password, clicking a link, approving a payment. There is no clever code involved. The attacker pretends to be someone you already trust, a colleague, your bank, tech support, a delivery driver, and lets your own good nature do the work.

Put plainly, it exploits human trust, not a flaw in software. A caller who says "This is IT, there is a problem with your account and I just need your password to fix it" has hacked nothing. If you say the word, you have simply handed over the key.

Why people are the easy target

You can have the strongest password and the newest phone and still be talked into opening the door. A single moment of distraction, kindness or stress can undo every technical protection. Security professionals call people the weakest link, not because anyone is foolish, but because we are all human and human tendencies are predictable.

Three ordinary ones do most of the damage:

• Trust: a message that looks familiar is assumed to be genuine.
• Habit: we click, reply and approve on autopilot, dozens of times a day.
• Pressure: when we are rushed or worried, we stop checking.

None of these is a weakness of character. They are how normal people get through a normal day. The attacker's whole craft is arranging a moment where one of them fires before you think.

The attacker studies you first

A good social engineer does homework. They learn your role, your manager's name, the suppliers you deal with, even the way your company phrases its emails. Much of this sits in public on social media, so it costs the attacker almost nothing. Then they craft a message that fits neatly into your day, so nothing feels out of place. The more it matches what you expect, the less you question it.

The good news

Because the trick targets a person, a person can stop it, and you do not need to be technical to do so. You need a couple of habits: slow down when something asks you to act, and verify anything unexpected through a separate, trusted channel before you do it. That is the thread running through every lesson in this module. Recognising the trick is most of the defence.