Social Engineering: How Criminals Manipulate Us

Social engineering means manipulating someone into sharing information, sending money or granting access. This guide helps families and educators recognise the pressure behind a request and practise a safer response. Understanding the behaviour matters alongside account and device protections.

If someone has already sent money, shared a code or allowed access, use I think I have been scammed: what to do next. You can seek help without first proving exactly how the approach worked. The person responsible for the deception is the offender.

What is social engineering?

The Council of the EU describes social engineering as deception that draws on trust and human behaviour. A criminal may pretend to be a friend, bank employee, recruiter or helpful stranger. For example, the immediate request might seem small, such as opening a document or reading out a code.

However, the aim can extend beyond money. An offender may want access to an email account, private photographs, identity documents or a device. They may also ask someone to move funds for them, recruit friends or keep a conversation secret.

INTERPOL’s social engineering overview connects several familiar fraud types through the exploitation of trust. Phishing is one method within this wider pattern. A long conversation or relationship can involve social engineering even when no suspicious link appears.

How social engineering develops

Social engineering operates at an international scale. In Operation First Light 2026, INTERPOL coordinated action across 97 countries and territories between 15 January and 30 April. It reported 5,811 arrests and more than 142,000 identified victims in an operation targeting impersonation, romance, investment and other social engineering scams. These are international operational results, not an estimate of Irish victim numbers or the total global incidence of fraud. INTERPOL also reported investigative action against scam centres. This reinforces the importance of disrupting organised networks as well as recognising the manipulation used in individual fraud attempts. The practical lesson remains to examine the requested action, independently verify the contact and promptly report suspected crime.

A criminal may start with information gathered from public posts, exposed records or an account they control. They can then build a story that fits the person’s interests or circumstances. For example, a message about a school payment may arrive during a busy school week.

Next, they may offer apparent proof, encourage a small action and increase the demand later. A familiar account, convincing document or small initial payment can make the story feel credible. However, some approaches last minutes, while others involve repeated contact over months.

These are useful patterns to recognise, rather than a fixed sequence. An offender may skip stages, change identity or switch from reassurance to threats. Therefore, examine the requested action each time, even after an earlier conversation seemed harmless.

Common types of social engineering

Recognise the request behind the technique. Pretexting uses a fabricated role or situation, such as a supposed bank investigation. Baiting offers a reward or useful file in exchange for an unsafe action. A quid pro quo approach promises help or a benefit, such as technical support, in exchange for access or information. Criminals can combine these methods with phishing, fake friendships and account impersonation. The most useful question is not always which label applies, but what the sender wants you to do and whether you can verify the request independently.

• Phishing uses deceptive messages or websites to obtain information, money or access. Targeted phishing uses details about a particular person.
• Scam texts and calls use a phone or messaging service. The labels smishing and vishing refer to text and voice approaches.
• QR scams use a code to lead someone towards a deceptive destination or payment request. A QR code is a route, not proof of trust.
• Impersonation involves pretending to be someone else. Similarly, a compromised real account can carry the deception.
• Pretexting means inventing a reason for a request, such as a supposed security check.
• Baiting offers something attractive, such as game currency or exclusive access, to encourage an unsafe action.
• Fake support claims to solve a problem while seeking account or device access.
• Relationship manipulation builds affection or friendship before introducing financial pressure, secrecy or exploitation.

These labels can overlap. For example, a fake support agent may first make contact through a phishing email and later call the person. Learning the labels helps discussion, but recognising the action and pressure is more useful than naming every variation.

Social engineering pressure tactics

2026 verification advice: The US FTC’s January 2026 warning describes callers using genuine personal information to create a false sense of authority. Names, addresses or partial account details can be stolen or purchased. End unexpected fraud or security calls, then contact the organisation using its official app, a trusted statement or the number on your bank card. Do not rely on a sponsored search result for its telephone number. In Ireland, report suspected crime to An Garda Síochána.

Authority can make an instruction seem compulsory. Urgency can make checking feel like a dangerous delay. Fear, affection, curiosity and the wish to help can each give a request emotional weight.

• Authority: “I am dealing with fraud on your account.”
• Urgency or scarcity: “Act now or lose the offer.”
• Affection or belonging: “If you trust me, help me.”
• Compassion: “Someone you love needs money immediately.”
• Reward or curiosity: “Claim this prize or see this private message.”
• Obligation: “I helped you, so you owe me.”
• Apparent social proof: “Everyone in this group has already earned money.”

None of these emotions proves that a request is fraudulent. However, pressure becomes especially concerning when it blocks independent checking or demands secrecy. A genuine looking identity does not remove the need to verify a high risk action.

Why social engineering can affect capable people

Being intelligent or confident with technology does not make someone immune. For example, a message may fit a real delivery, job application, school event or financial worry. Distraction and time pressure can leave less room to question it.

NIST’s phishing research considers the relationship between a message and the recipient’s context. Its workplace research does not establish a risk score for a child. However, it supports looking beyond spelling errors when explaining why some messages are difficult to recognise.

Isolation, grief, financial strain or a major life change can make a particular story more meaningful. These circumstances do not determine who will be scammed. Avoid assuming that age, disability or technical experience tells you whether someone can judge a request.

Why online manipulation can continue

Scamwatch’s guidance for helping a loved one describes emotional attachment, growing commitments and fear of judgment. Someone may want to recover money already sent or protect a relationship they believe is real. Fabricated profits and small early withdrawals can strengthen that belief.

In addition, the person may fear losing independence if they disclose what happened. A criminal can exploit that fear through secrecy or threats. As a result, ridicule and confrontation can make an already difficult conversation harder.

However, these behavioural explanations do not mean that a particular brain chemical controls every decision. People respond differently, and several influences can operate together. The practical aim is to create time, independent information and a safe route to help.

Social engineering, AI and account access

The FBI’s warning on AI enabled financial fraud describes fabricated profiles, documents, voices and video. Fluent wording or a familiar voice is therefore insufficient proof of identity. A lack of obvious visual mistakes does not establish that a video is authentic.

Europol’s IOCTA 2026 also describes the use of generative AI to personalise social engineering. This does not mean every scam uses AI. Families need a checking habit that works whether the offender uses advanced software or an ordinary false story.

The FBI’s consent phishing alert explains access gained through an approval rather than a stolen password. For example, a request may ask you to link a device or allow an app to read information. Treat unexpected permissions as a security decision, even when the sign in page belongs to a real provider.

How to interrupt social engineering

• Pause the action. Stop before sending money, sharing a code or approving access.
• Leave the pressured channel. End the call or stop replying rather than debating the story.
• Choose an independent route. Open the official app or use contact details you established separately.
• Check the request itself. Confirm the amount, recipient, purpose and permissions being requested.
• Involve someone you trust. A second person can help check the story without taking over your decisions.
• Act if access was granted. Use the provider’s official recovery process and the response guide.

For example, a family safety word can prompt a pause during a supposed emergency. However, someone may overhear or disclose it. Read our AI impersonation and fake emergency guidance and still verify through a trusted route when money or safety is involved.

Social engineering: fictional scenarios

The following examples are fictional teaching exercises. Discuss them openly instead of testing someone through a deceptive message. No family member or pupil needs to reveal a real password, private safety word or personal experience.

A gaming friend offers currency

A familiar player offers free currency if a child signs in through a link. They say the reward will disappear in five minutes. The account may belong to a friend whose login someone else now controls.

Spot the Pressure: The claimed identity is a friend. The requested action is a login. Reward and urgency create pressure, while the sender’s identity remains uncertain. Check through a separate established conversation and use the game’s official service. Read Gaming Scams and Virtual Items for these approaches.

A teenager receives an easy money offer

Someone offers a teenager a commission for receiving and forwarding money. They describe it as harmless work and ask for secrecy. A small first payment makes the arrangement seem genuine.

Spot the Pressure: The claim is a job opportunity. The action involves moving money through the teenager’s account. Reward and belonging matter, while the source of funds is unclear. Stop and check with a trusted adult and the bank. Our Money Mules and Financial Exploitation guide explains account lending and financial pressure.

An apparent family emergency

A message appears to come from a parent using a new number. It asks for an urgent payment and says a voice call is impossible. The sender knows details about a family trip.

Spot the Pressure: The claim is a relative in difficulty. The action is a payment. Affection and urgency matter, while the new number remains unverified. Contact the relative using a number already known to you. Read AI Impersonation and Fake Emergency Scams for further examples.

A supposed bank fraud team calls

A caller says money is at risk and instructs someone to transfer it to a safe account. They discourage hanging up because the situation is supposedly urgent. The displayed caller name looks familiar.

Spot the Pressure: The claim is bank authority. The action is transferring funds. Fear discourages checking, while the caller’s identity remains uncertain. End the call and contact the bank through its official app or a trusted number.

A school payment request arrives

A message in a parent group requests a changed payment destination for a trip. It includes the correct teacher’s name and asks everyone to pay before lunchtime. Other accounts appear to agree.

Spot the Pressure: The claim is school approval. The action is a payment to new details. Time pressure and apparent agreement matter. Confirm the change through the school’s established office or payment system.

An unexpected recruiter offers paid tasks

A recruiter promises earnings for rating products. A dashboard shows a growing balance, but withdrawal requires a deposit. The recruiter says a final payment will unlock everything.

Spot the Pressure: The claim is paid work. The action is sending money. Reward and the wish to recover earlier deposits matter. Verify the employer independently and stop paying to release supposed earnings. Our Fake Jobs, Task Scams and Online Earnings guide explains task and earnings approaches.

A support agent requests access

A caller claims a device has a security problem. They ask for a login code, device link or remote control app. A professional tone makes the request sound routine.

Spot the Pressure: The claim is technical authority. The action grants access. Fear and helpfulness matter, while the caller’s right to act is unverified. End the contact and obtain support through the provider’s established channel. Use Account Takeover, Identity Theft and Fake Technical Support if access was shared.

Helping someone affected by social engineering

First, start with a specific observation, such as a request for secrecy or another fee. Ask whether you can check it together. Listen to what the relationship or opportunity means to them before challenging its claims.

For example, say: “I can see why this feels convincing. Can we contact the organisation separately before you send anything else?” Avoid threats to remove a device or take control of finances as the first response.

INTERPOL’s 2026 financial fraud assessment recognises that harm can include distress and loss of trust, as well as money. A supportive response matters even when a bank cannot recover a payment. Where coercion or child exploitation appears, use appropriate safeguarding and police routes.

Social engineering practice checklist

• Choose one fictional situation at a calm time and allow breaks.
• Ask who the person claims to be, what they want and how to check.
• Practise a text based checking route as well as a voice call.
• Agree that asking for help will not lead to blame.
• Review account security separately from recognising manipulation.
• Keep trusted bank, school and support routes easy to find.

Social engineering questions

Can settings prevent every approach?

No. Settings can limit contact or protect a login, but they cannot establish another person’s intentions. Therefore, combine suitable controls with independent verification and an open route to help.

Does a message from a real friend prove it is safe?

No. Someone may control the friend’s account or imitate their identity. Check an unusual request separately, particularly when it involves money, codes or device access.

Must I prove a scam before asking for help?

No. Explain what happened and what you shared. Your bank, platform or Garda station can advise within its remit, even if you cannot name the technique.

Related CODA guides

Use I think I have been scammed: what to do next for response actions. Continue with Protecting Personal Information Online and Digital Footprint for prevention. Return to Scams and Fraud or Resources for Parents. For message and QR examples, read Phishing, Scam Texts, Calls and QR Codes. Similarly, our Recovery Scams and Repeat Targeting guide explains repeat targeting.

References

Council of the EU: social engineering. Definition and common techniques.

INTERPOL: social engineering scams. Shared trust mechanisms across fraud types.

NIST: phishing research. Message difficulty and user context, with workplace research limits.

Scamwatch: understanding manipulation. Attachment, circumstances and supportive intervention. Australian reporting directions do not replace Irish routes.

FBI/IC3: AI enabled financial fraud. US warning covering synthetic text, images, voices and video.

Europol: IOCTA 2026. Online fraud and AI context, particularly the fraud chapter.

FBI/IC3: consent phishing, September 2026. App permission risks and revocation.

INTERPOL: Global Financial Fraud Threat Assessment 2026. Selected fraud and human harm sections. Not an Irish prevalence estimate.

About Children of the Digital Age

Children of the Digital Age provides online safety education and training for families, schools and organisations. Our work combines practical cybersecurity guidance with online behaviour and cyberpsychology. We help people understand risks, protective choices and the limits of technology.

Send a message

Contact Us about parent sessions, school presentations or online safety training. Please do not send passwords, banking codes or intimate images through this form. Use the official reporting routes above for urgent concerns.

Last updated: 26 October 2026