TechKnowSurge
TechKnowSurge Catalog Videos Social Engineering Methods
VideoSecurityFree

Social Engineering Methods

Social engineering attacks exploit human psychology through overt tactics like blackmail and covert techniques like phishing, using emotional triggers such as curiosity, fear, greed, and urgency to manipulate targets into compromising security. Recognizing these emotional manipulation patterns and responding with deliberate, logical thinking is the foundation of effective social engineering defense.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Social engineering is the practice of manipulating people into actions or disclosures that compromise security, and its methods are broadly divided into overt and covert approaches. Overt social engineering involves direct, confrontational tactics — blackmail and bribery are common examples — where the attacker makes no effort to conceal their intent. Covert social engineering, by contrast, operates beneath the target's awareness, using deception and misdirection to guide behavior without the target realizing they are being manipulated. Phishing campaigns are a defining example of covert methods, and they represent one of the most prevalent threat vectors in modern cybersecurity. The success of social engineering, regardless of method, depends on emotional manipulation. Attackers engineer messages that trigger specific psychological responses — curiosity, the instinct to help others, greed, fear, and urgency — because emotional arousal reduces critical thinking and accelerates action. A message claiming a large unclaimed sum exploits desire; a threat to expose sensitive information to friends and family exploits fear; a message impersonating a senior executive in need of assistance exploits the deeply human impulse to be helpful. Urgency is layered into nearly all of these tactics, whether through limited-time offers, scarcity messaging, or implied consequences for delay, because time pressure is one of the most reliable ways to prevent a target from thinking logically. Effective defense against social engineering is fundamentally a training problem. Users who understand that emotional activation is itself a warning signal are better positioned to pause, question the legitimacy of a request, and apply logical scrutiny before acting. Teaching people to slow down when something feels off — to ask whether a communication makes sense given normal organizational behavior, and whether the pressure to act immediately is itself suspicious — is the core competency that reduces an organization's vulnerability to social engineering attacks across all delivery methods.

What you'll learn

What's covered

Social Engineering Methods

Key terms

Social Engineering
A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Phishing
A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
Overt Social Engineering
A direct, confrontational form of social engineering in which the target is aware of pressure being applied, such as through blackmail or bribery.
Covert Social Engineering
A subtle form of social engineering in which the target is unaware they are being manipulated, such as through a phishing campaign.
Emotional Manipulation
The use of psychological triggers such as curiosity, urgency, fear, or greed to influence a target's behavior during a social engineering attack.
Urgency
A social engineering tactic that pressures a target to act immediately, reducing the likelihood of logical evaluation before compliance.

Topics

Social Engineering Cybersecurity Phishing Human Psychology Threat Awareness Emotional Manipulation

Transcript

To successfully carry out social engineering, we're going to need to trick someone into saying or doing something that will lead to a compromised security. So what does that look like?

Overt and covert methods

First of all, I want to point out that there are two very broad categories when it comes to methods in social engineering. One of them is being overt, and the other one being covert. Covert means that the person doesn't realize that they're being manipulated or controlled, versus overt is we're very direct about this and very confrontational, perhaps even maybe it's some sort of threat or fear that we have over them to do something. Covert would mean we're kind of tricky about it and they don't realize that we're trying to get them to do something. So an example of overt might be something like blackmail or a bribe, versus something that's covert might be like a phishing campaign.

Emotional manipulation

A huge part about social engineering success is going to be around emotional manipulation. Can we evoke some emotion in the person to the point where they can react, or they are going to do something about it? So some emotional responses that we could create to do some sort of social engineering might be something around curiosity, or this urge for helpfulness, or a desire or greed. Maybe it's fear. And we probably most likely want to use some sense of urgency with it.

The quotes that follow are designed to evoke some sort of emotion that you might see in some sort of phishing campaign, some sort of phishing email that's sent to you. And they're going to look a lot like advertising, because let's face it, a lot of advertisements are really a form of social engineering. They're trying to get you to buy something whether you need it or not, to evoke emotion to get you to buy something. So we're going to take a look at a few of these emotions and a quote that could be associated with those emotions.

Curiosity

"Look who started this amazing career. Maybe you should start it, too." This is designed to evoke some sort of curiosity. I look at this and I say, okay, well, who is it? Somebody that I know who started — and what career did they start? And maybe I am interested, I don't know. That piques my curiosity there. So this is one of those things that could evoke this emotion of curiosity, to look further into this and read a little bit further.

Helpfulness

"I'm in a conference right now and I don't have access to a computer. Can you help me out?" This was an actual text that was sent from supposedly the CEO, or somebody pretending to be the CEO, to one of the employees of the company that I worked for. There's no reason why the CEO would have reached out to this particular person, but this particular person felt like the need to help out: it's the CEO and he's contacting me. So what she did is she used her personal email, or personal account, to buy Google Play cards, and then sent it to this scammer.

This is the type of stuff that's out there, because we feel, as humans, we feel this need to help other people. And that's great. That is an awesome way to go about life, to help other people, but it can get us in trouble, and it can get us to fall for things like this if we're not on guard.

Greed

"Claim your $23,581." Now, this is something that you see a lot of: this idea that, oh, I have $23,000 sitting out there. Yeah, I want that money, I want to claim that. This desire to get to it. I don't know if it would be necessarily greed in this case, but there is this greed that can creep into this as well. And this is an emotion that propels us to act, like, yes, I want this opportunity for this $23,000.

Fear

"We have proof that you did this and we are not afraid to forward it on to your family." In fact, I just watched a Black Mirror episode this last week that actually talked about just this, or used just this, in one of their episodes. We have this fear. Oh no, you have proof of me doing what? And you're going to forward it to my friends and family? That's devastating. I don't want to do that. I better act now, I better take action on this. And so it develops this fear that propels us into action, and not thinking clearly about, do they really have proof of anything? What would they have proof of, and are they really going to forward it to friends and family?

Somehow we need to get the users of our networks to recognize these emotional manipulations, and then start thinking about logically, is the CEO really going to contact me for this need, or are they going to contact somebody else in the company? So we need to somehow move that to logic, and that naturally happens with time. Over time our logical brain starts kicking in and starts thinking of things logically and really starts questioning things.

Urgency

And so most scammers, most people who are doing some sort of social engineering, are going to propel some sort of urgency. They're going to have something about their message that feels like we need to do this now. We might lose out if we don't do it now, or we might get in trouble if we don't do it now, or some reason why this has to happen immediately, because we're more likely to act if there's that sense of urgency.

"Get this deal now. It's only available for a limited amount of time." This once again propels us into that sense of urgency. So these are the type of messages that we're going to see to propel us to that urgency.

"Only 10 more available. Make sure you get one." This is another example of urgency in the form of scarcity. There's only a certain amount that's available, and if you don't act now, you will miss out.

When we're training our users for recognizing emotional manipulation, what we really need to do is just teach them how to slow down when they hear something that doesn't feel right, and really just think about it logically. So that's what we want to impress and train our users to do.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →