Cyber-Awareness Series

Social Engineering: When Attackers Target People, Not Systems

Introduction

In our digital world, we often focus on firewalls, antivirus software, and complex encryption. However, cybercriminals have realized that it is often much easier to hack a person than it is to hack a computer. They don’t always need to exploit a technical bug; they can simply exploit our trust, curiosity, or desire to be helpful.

Statistics show that between 60% and 68% of data breaches involve a human element. Whether it is clicking an urgent-looking link or providing a password over the phone, human error remains a dominant driver of security incidents.

Understanding the psychological tricks behind social engineering is the first step in building a “human firewall” to protect our community.

What is Social Engineering?

Social engineering is when cybercriminals manipulate people into sharing information, giving access, transferring money, or performing an action that helps the attacker. It is effectively a “people hack” that bypasses technical defenses by targeting the user directly.

Attackers use a variety of tactics to build trust or create pressure, such as:

Phishing: Fake emails designed to steal credentials, e.g. “Your university email account will be suspended. Verify your password here.”

Spear-phishing: Fake and targeted email, e.g. “Hi Finance Team, please urgently transfer MWK 2,500,000 to the account below for the research project.”

Pretexting: Fabricating a scenario, like an “urgent IT issue,” to get you to act, e.g. “I’m from ICT. We’re resolving an urgent account issue. Please confirm your username and MFA code.”

Baiting: Offering free software or gifts to install malware, e.g. “Free AI research tool — download now to unlock premium features.”

Vishing: Phone-based attacks using impersonation or even AI voice cloning, e.g. “Hi, this is your supervisor. I’m in a meeting and need you to urgently send me the research files.”

Tailgating: Following an authorized person through secure doors, e.g. “I left my access card inside. Could you please hold the door for me?”

They create a believable situation and try to make you act before you have time to think. Even if our systems are technically secure, an attacker only needs one person to bypass them through manipulation.

The Psychology Behind Social Engineering: Why Do People Fall for These Attacks?

Social engineering doesn’t depend only on technical skills. Attackers understand human behaviour and use it to influence our decisions. They often target emotions such as:

  1. Trust: Criminals pose as authority figures, like managers or IT support. They want you to feel that questioning the request is inappropriate, e.g. “This is the Director. Send me the document immediately.”
  2. Urgency: They use threatening language or “act now” demands to prevent you from thinking, e.g. “Your account will be disabled in 10 minutes!”
  3. Fear: They want you to panic, claiming your account is blocked or a payment has failed, e.g. “Your account has been compromised. Verify your password now.”
  4. Curiosity: They bait you with interesting news or free offers, e.g. “See the confidential results attached.”

In an academic environment, attackers often target researchers and students specifically because they handle valuable data and use interconnected networks.

A single mistake can allow an attacker to disrupt institutional operations, steal research data, or commit identity theft.

Common Warning Signs

Be cautious when someone:

  1. Creates a sense of urgency
  2. Asks for passwords or sensitive information
  3. Requests an unusual payment or transfer
  4. Wants you to bypass normal procedures
  5. Asks you to keep something secret
  6. Pressures you not to verify their identity

Remember, people can be manipulated. Don’t let trust replace verification. This is why we must always stop and verify before we react.

Best Practices for Avoiding Social Engineering

You don’t need to be a cybersecurity expert to stop a social engineering attack. Building your “human firewall” involves staying vigilant and following these key procedures:

To protect yourself and your institution:

  1. Always verify the identity of anyone requesting sensitive info, even if they seem familiar.
  2. Be suspicious of extreme urgency, secrecy, or threats in messages.
  3. Never share passwords, PINs, or OTPs via email or over the phone.
  4. Use out-of-band communication (like calling a known number) to confirm unusual requests.
  5. Report all suspected social engineering attempts to your ICT or Security Team immediately.

Remember: Reporting a suspicion is not your fault, and early reporting protects everyone.

Summary

Social engineering proves that cybersecurity is not just an IT problem—it is a human one.

By understanding the tactics of manipulation, such as phishing, spear-phishing, baiting, pretexting, vishing, and tailgating, you can better protect yourself from being exploited. Awareness is your strongest defense against attackers who try to “hack” your trust.

Whether you are a student, researcher, or member of staff, being a “human firewall” makes a significant difference in protecting our community’s data, research, and reputation.

Technology can protect systems from technical threats. Attackers target the people behind them. Don’t let manipulation become their way in.