A phone call to an IT help desk. A text about a missed parcel. A QR code stuck to a car park meter. None of these need a single line of malicious code, yet each one has been used to break into a major UK company in the past two years. Social engineering attacks work by manipulating a person rather than hacking a system, and they are now behind the large majority of confirmed data breaches worldwide. This guide sets out the current statistics, the main attack types you are likely to meet in 2026, real UK cases, and the practical steps that actually reduce your risk, whether you are protecting a household or a workforce.
Table of Contents
What Is a Social Engineering Attack?
A social engineering attack is any attempt to manipulate a person into handing over information, access, or money, rather than exploiting a flaw in software or hardware. The target is human judgement: trust, urgency, fear, or a simple wish to be helpful.
This matters because most of the money spent on cybersecurity still goes on firewalls, antivirus tools, and network monitoring, none of which stop a convincing phone call. Antivirus software scans code and file behaviour; it has no way to evaluate whether the person asking you to reset a password is who they claim to be. That gap between technical defences and human judgement is exactly where social engineering attacks operate, and it is why training and identity verification matter as much as any piece of security software. For a fuller breakdown of how attackers build trust before they strike, our guide to social engineering meaning and types covers the psychology in more depth.
The Four Stages of a Social Engineering Attack
Most successful attacks, whether a five-minute phone scam or a months-long corporate breach, follow a similar four-step pattern. Recognising each stage makes it far easier to spot an attack while it is still happening.
Reconnaissance
The attacker researches the target first. LinkedIn profiles, company websites, and social media posts hand over names, job titles, colleagues, and daily habits, all of which make a later approach sound credible.
Building Trust
Using what they have learned, the attacker makes contact and establishes a plausible reason to be trusted: posing as a colleague, an IT technician, a supplier, or a bank representative.
The Attack
Once trust is established, the attacker asks for the thing they actually want: a password reset, a payment, a login code, or access to a building or device.
Covering Tracks
A skilled attacker closes the interaction cleanly, deletes evidence where possible, and moves on before the target has time to question what just happened.
How Common Are Social Engineering Attacks? UK and Global Statistics
Numbers on this topic vary depending on how “social engineering” is defined, so the figures below are shown with their original source rather than blended into a single headline percentage.
The most widely cited baseline comes from the Verizon 2025 Data Breach Investigations Report, which found that around 60% of confirmed data breaches involved a human element, such as a malicious click, a socially engineered phone call, or misdirected data. Within Verizon’s own attack-pattern classification, social engineering specifically was identified as a factor in 17% of breaches, and prompt bombing, a form of MFA fatigue attack, appeared in 14% of incidents.
On the UK side, the government’s Cyber Security Breaches Survey 2025/2026 found that 38% of UK businesses experienced a phishing attack in the past year, that phishing was rated the most disruptive attack type by 69% of affected businesses, and that 12% of businesses reported someone impersonating their organisation or staff.
| Statistic | Figure | Source |
|---|---|---|
| Breaches involving a human element | 60% | Verizon 2025 DBIR |
| Breaches where social engineering is the specific pattern | 17% | Verizon 2025 DBIR |
| Breaches involving prompt bombing (MFA fatigue) | 14% | Verizon 2025 DBIR |
| UK businesses experiencing phishing in the past year | 38% | UK Cyber Security Breaches Survey 2025/2026 |
| Businesses rating phishing as the most disruptive attack | 69% | UK Cyber Security Breaches Survey 2025/2026 |
| Businesses reporting impersonation attempts | 12% | UK Cyber Security Breaches Survey 2025/2026 |
| FBI IC3 business email compromise losses, 2024 | $2.77 billion | FBI Internet Crime Report 2024 |
| Rise in vishing attacks, late 2024 | 442% | CrowdStrike 2025 Global Threat Report |
| Microsoft-detected MFA fatigue attacks in a year | 382,000 | Microsoft threat intelligence |
Two things stand out from these figures. First, phishing remains by far the single most common route in, even as newer methods such as quishing and voice cloning grab headlines. Second, prompt bombing and impersonation are no longer fringe techniques; they show up often enough in national statistics to be treated as mainstream threats rather than edge cases.
Common Types of Social Engineering Attacks
Attackers rarely stick to one method. A single campaign against a business might combine a phishing email, a follow-up phone call, and a QR code, so it is worth knowing the full range rather than just the most famous one.
Phishing and Spear Phishing
Phishing uses fake emails or messages that mimic a trusted sender to harvest passwords or financial details. Spear phishing narrows the target to a specific person, often a finance or HR employee, using personal detail gathered during reconnaissance to make the message convincing. Our guide to phishing and pharming attacks covers the technical side of how these messages are built and redirected.
Vishing and MFA Fatigue
Vishing is phishing carried out over a phone call, and it has grown sharply as attackers have realised how effective a confident voice can be against a busy help desk employee. A closely related technique, MFA fatigue or push bombing, floods a victim’s phone with repeated authentication requests until they approve one out of sheer irritation or confusion, often at 11pm when nobody wants to keep declining a notification.
Quishing
Quishing is phishing delivered through a QR code rather than a text link. Because most email security tools scan text and attachments rather than images, a malicious QR code slips past filters that would catch the same link written out in full. Quishing accounted for roughly 12% of all phishing attacks in 2025, up from under 1% in 2021, and it disproportionately targets mobile users who cannot easily preview where a scanned code will send them.
Pretexting and Help Desk Impersonation
Pretexting means inventing a believable scenario, such as posing as a new starter locked out of their account, to talk a real employee into bypassing normal checks. Help desk impersonation is a specific and increasingly damaging version of this: an attacker calls a company’s own IT support line pretending to be a staff member, and asks for a password or MFA reset. Several of the largest UK and US breaches of the past three years began with exactly this ten-minute phone call.
AI Voice Cloning and Deepfakes
A short clip of someone’s voice, sometimes only a few seconds pulled from a podcast, webinar, or company video, is now enough for readily available software to generate a convincing impersonation. Attackers have used this to fake urgent instructions from senior executives, and in one widely reported case, a live video call made up entirely of deepfaked colleagues was used to authorise a fraudulent transfer. Voice and video can no longer be treated as reliable proof of who is really on the other end of a call.
Baiting and Tailgating
Baiting offers something enticing, an infected USB drive left in a car park, a “free” download, or a fake prize, to trick someone into installing malware themselves. Tailgating is the physical equivalent: an unauthorised person simply follows an employee through a secure door, relying on politeness rather than any technical trick. Our guide to common types of malware explains what typically happens once a baited device or download is opened.
Real UK Attacks That Show the Cost
Two of the UK’s best-known 2025 retail breaches began with almost identical social engineering attacks. In April 2025, Marks & Spencer disclosed a ransomware attack after attackers impersonated an employee and convinced a third-party IT contractor to reset their credentials, leading to a reported cost of around £300 million and a six-week suspension of online ordering.
Days later, Co-op confirmed a related breach after its own help desk was targeted in a similar way. Both incidents are widely attributed to the same loosely organised hacking collective, which had previously used the identical tactic, a single impersonation phone call to an IT help desk, to breach the US casino operator MGM Resorts in 2023, at an estimated cost of around $100 million.
The AI-driven version of this problem has already produced a headline-making loss too. In February 2024, an employee at the Hong Kong office of engineering firm Arup was tricked into transferring $25.6 million after joining a video call in which every other participant, including a senior colleague, was an AI-generated deepfake. None of these cases involved a software vulnerability. Each one relied on a person being convinced, briefly, that they were talking to someone they trusted.
Warning Signs of a Social Engineering Attempt
Most social engineering attacks share a handful of tell-tale features, regardless of whether they arrive by email, phone, text, or in person.
- An unusual sense of urgency, pressure to act “right now” before you can check with anyone else
- A request to bypass a normal process, such as skipping identity checks or approving a payment outside the usual system
- Contact from an unfamiliar number or address claiming to represent someone you already know
- A request for information that a genuine caller or sender should already have
- An unexpected attachment, link, or QR code, especially one that creates pressure to scan or click immediately
- A tone that swings between flattery and threat, both are used to short-circuit careful thinking
If any of these appear together, it is worth pausing and verifying through a separate, known channel before doing anything else.
How to Protect Yourself and Your Organisation
Protection against social engineering attacks works best as a mix of habits and technical controls, since neither one alone is reliable.
For Individuals and Families
Slow down before acting on anything urgent, and verify unexpected requests through a channel you already trust, such as calling a company back on the number printed on your card rather than the one in a message. Use a password manager so that a single stolen password cannot open every account you own, and turn on two-factor authentication wherever it is offered. If you believe your details have already been exposed, our guide to identity theft protection services explains how ongoing monitoring works. Our wider guide to protecting yourself against cybercrime covers password hygiene and account recovery planning in more detail.
For Organisations
The National Cyber Security Centre’s guidance on phishing sets out a four-layer defence model that applies well beyond email: make it difficult for attackers to reach your people in the first place, help staff recognise and report suspicious contact, limit the damage a successful attempt can cause, and respond quickly when something does get through. Strict identity verification at the help desk is essential given how many recent breaches began with exactly this weak point; agents should never reset a password or MFA device based on caller information alone.
Businesses working towards the government-backed Cyber Essentials scheme will find that several of its baseline controls, particularly around access management and authentication, directly reduce social engineering risk. You can read the NCSC’s full phishing defence guidance for the detailed technical recommendations behind this model.
What to Do If You Fall Victim (UK and Ireland Reporting Steps)
If you think you have responded to a scam email or call, act on three fronts at once rather than one after another. Contact your bank immediately if any financial details or payments were involved. Report the incident to Action Fraud if you are in England, Wales, or Northern Ireland, or to Police Scotland if you are in Scotland, and forward any suspicious email to the NCSC’s Suspicious Email Reporting Service at report@phishing.gov.uk, or a suspicious text to 7726.
Readers in Ireland can report incidents to Ireland’s National Cyber Security Centre. If personal data was accessed as part of a business breach, UK GDPR requires notification to the ICO within 72 hours of becoming aware, and Irish organisations face the equivalent requirement to the Data Protection Commission.
Building a Culture That Reports Attacks Instead of Hiding Them
Annual, tick-box training videos rarely change behaviour, and blaming an individual employee for falling for a well-researched attack misses the point. If one person clicking a link can bring down an entire network, the weakness sits in the system, not in that person’s judgement.
Building a culture where staff feel safe reporting a suspicious call or a mistaken click, without fear of disciplinary action, consistently shortens the time between a successful attack and a company noticing it.
Social engineering attacks change shape faster than most other cyber threats because they exploit trust and habit rather than a fixed piece of software. The techniques on this page, from a ten-minute help desk phone call to a deepfaked video meeting, were barely discussed three years ago and are now behind some of the UK’s costliest breaches. Have you come across a phishing text, a suspicious QR code, or an odd phone call recently? Tell us what warning sign gave it away in the comments, it may help another reader spot the same trick before it works on them.
Frequently Asked Questions
What is the main difference between phishing and social engineering?
Phishing is one delivery method, usually email or text, within the much broader category of social engineering, which covers any psychological manipulation used to gain information or access, including phone calls, physical impersonation, and QR codes.
Can antivirus software stop a social engineering attack?
No. Antivirus software monitors and blocks malicious code; it has no way to judge whether a caller or email sender is genuinely who they claim to be. Preventing social engineering relies on identity verification and staff awareness rather than software alone.
What is MFA fatigue, and why does it work?
MFA fatigue, also called push bombing, is when an attacker who already has a stolen password floods the real account owner with repeated authentication requests until they approve one out of tiredness or confusion. It works because it targets exhaustion rather than any weakness in the MFA system itself.
How dangerous is AI voice cloning in practice?
Very. A handful of seconds of publicly available audio is now enough to generate a convincing impersonation of someone’s voice, which is why phone or video contact alone should no longer be treated as reliable proof of identity for sensitive requests such as payments or password resets.
What is the single most effective defence against social engineering?
A strict, non-negotiable identity verification process for any sensitive request, combined with phishing-resistant hardware security keys where possible. No amount of staff awareness training removes the need for a process that does not rely on trusting a voice or an email alone.