Key Takeaways
- Business email compromise (BEC) caused over $3 billion in reported losses in 2025. These attacks usually involve impersonating trusted contacts to trick employees into making fraudulent payments. (IC3)
- Mobile-based social engineering attacks had a 40% higher median click rate than traditional email phishing in simulated attacks. These attacks use deceptive text messages and phone calls to manipulate victims. (Verizon DBIR)
Introduction
Social engineering attacks differ from other cyberattacks most businesses face. In this type of attack, attackers exploit human trust rather than depending only on technical vulnerabilities. They impersonate employees or business partners to trick people into sharing sensitive information or transferring money. In some cases, they are also granted unauthorized access to company systems.
Since these requests appear to come from legitimate sources, employees may fail to recognize the deception and fall victim to the attacks. A single successful attempt can cause businesses significant financial losses and data breaches. It also disrupts business operations, which then may take weeks or months to restore.
This blog explores how social engineering attacks target businesses and what methods attackers use. Along with that, there are real-world examples and practical steps organizations can take to prevent these attacks.
What Are Social Engineering Attacks in Business?
Social engineering attacks involve manipulating people into revealing sensitive information or taking certain actions that jeopardize an organization’s security. Attackers don’t only rely on technical vulnerabilities to carry out these attacks, but they also exploit human behavior to achieve their goals.
Social engineering attacks involve impersonating trusted individuals or creating a sense of urgency to pressure employees into taking action without verification. For example, an employee receives an email prompting them to reset their password via a link. The email appears to have come from the company’s IT department, but it's not. The employee doesn’t verify the email and clicks the link to enter their login credentials to reset the password. If the employee enters their credentials on the fraudulent page, attackers may capture them and use them to access company accounts.
Nobody in an organization is safe from these attacks. Attackers can attack anyone regardless of their role or seniority. At times, attackers can deceive even those familiar with common cyber threats.
How Do Social Engineering Attacks Target Businesses?
Attackers usually begin by researching a company and its employees through websites, social media profiles, and other publicly available sources. They use this information to make their communication appear credible and to identify potential targets within the organization.
After identifying the target, attackers impersonate a manager, IT support representative, or business partner. They send legitimate-looking requests to create a sense of urgency or pressure employees into acting without proper verification.
For example, an attacker can pose a supplier and request a change to the bank account used for invoice payments. The requests look legitimate at first glance, prompting the employee to process them without confirming through a trusted channel. That’s where they make the mistake and unknowingly transfer money to the attacker.
Attackers can use similar tactics to obtain sensitive information or gain unauthorized access to company systems.
Common Types of Social Engineering Attacks Against Businesses
Social engineering can take different forms, as everything depends on how attackers approach their targets. Some attackers find fraudulent messages or phone calls more effective, while others use deception to gain physical access to restricted areas.
1. Phishing and Spear Phishing
Phishing uses fraudulent messages to trick recipients into revealing sensitive information. The messages mostly include malicious links and attachments that users click or open, respectively, making them victims of phishing. Then there is spear phishing, which targets specific individuals using personal or company-related details to make the message more convincing.
2. Business Email Compromise (BEC)
In BEC attacks, attackers impersonate trusted business contacts or compromise legitimate email accounts to trick employees into transferring money into fraudulent accounts or sharing confidential information.
3. Vishing and Smishing
In vishing, attackers make fraudulent phone calls pretending to be someone the recipient trusts, while smishing uses deceptive text messages. Attackers often pose as IT support personnel or company representatives to obtain credentials or persuade employees to take unsafe actions.
4. Pretexting and Baiting
Pretexting involves creating a fabricated scenario to gain someone’s trust, which makes it easier to obtain information or access. Baiting uses tempting offers, such as free software downloads, to lure people into actions that compromise their security.
5. Tailgating and Physical Impersonation
Tailgating happens when an unauthorized person follows someone into a restricted area without proper authorization. Here, attackers can also pose as employees or contractors to gain entry to business premises.
6. AI-Powered Impersonation and Deepfakes
Attackers can use AI-generated messages and voices to deceive employees into believing that they are senior executives. Attackers can also use deepfake videos to make fraudulent requests appear more convincing. These techniques work more effectively when employees rely on familiar voices or appearances to verify someone’s identity.
Real-World Examples of Social Engineering Attacks on Businesses
1. Marks & Spencer Cyberattack (2025)
In 2025, British retailer Marks & Spencer suffered a cyberattack reportedly linked to the Scattered Spider group. According to public reporting, attackers impersonated an employee and convinced a third-party IT help desk to reset account credentials.
As they received new account credentials, they gained unauthorized access to several sensitive systems and caused disruption to operations. Online orders, which are among the primary drivers of business, were affected, as were other retail operations. M&S initially estimated that the incident could reduce its 2025/26 operating profit by approximately GBP 300 million before mitigation measures.
It also showed that weak identity verification procedures can expose businesses to serious security breaches.
2. Google Salesforce Data Breach (2025)
In June 2025, one of Google's corporate Salesforce instances was compromised through activity similar to attacks associated with UNC6040. The group is known for impersonating IT support personnel during phone calls to gain access to Salesforce environments. Google confirmed that attackers retrieved basic business contact information before their access was terminated.
This incident showed that fraudulent IT support requests can cause data theft without exploiting software vulnerability.
What Are the Risks of Social Engineering Attacks for Businesses?
There are long-term risks associated with social engineering attacks, but the extent depends on the techniques attackers use and the devices and accounts they are able to access. Here are common social engineering risks that most businesses may face as a result of social engineering attacks.
1. Financial Losses
Attackers use impersonation techniques to deceive employees with the motive of transferring money to fraudulent accounts. But this is not the only financial loss businesses have to deal with. There will be expenses related to the investigation of the incident and the recovery of affected systems.
2. Data Breaches and Credential Theft
The risk of attackers obtaining confidential business information is also high in social engineering attacks. Attackers use stolen login credentials for this purpose. The risk further increases if the compromised accounts contain customer and employee data, as attackers may expose that data as well.
3. Operational Disruption
When attackers compromise essential systems, it can bring business operations to a halt. In such cases, employees may not be able to access important applications until those affected systems are restored and secured by security teams.
4. Reputational Damage and Legal Consequences
The reputation of a business is also at great risk due to a social engineering attack. When attackers expose sensitive customer information, it becomes hard for customers to remain confident in the organization. But the trouble doesn’t end there; the organization may face regulatory scrutiny and even legal action, denting the reputation further and increasing the financial losses.
How to Recognize Social Engineering Attacks at Work
Social engineering attacks occur when attackers impersonate an employee or someone the victims already know or trust. They send genuine-looking messages, but there are certain warning signs that can help identify a possible social engineering attempt.
1. Unexpected Requests for Sensitive Information
When you receive messages requesting login credentials or confidential business information, be cautious. Even unexpected requests to approve a login attempt should be viewed with suspicion.
2. Urgent Payment or Account Changes
Receiving urgent requests to approve payments or change banking details could be a sign of a social engineering attack. Attackers use such tactics to reduce the time to verify and take immediate action. But this must be avoided. Any such request should be verified through a trusted communication channel.
3. Suspicious Links and Attachments
Attackers use fraudulent messages bearing the names of individuals whom employees trust to deceive them. Such messages may contain links to fake login pages or malicious attachments. It’s important for employees to check the messages with unexpected links, even when the sender appears familiar.
4. Unusual Requests from Trusted Contacts
Assuming a message is safe simply because it comes from a familiar email address can be a mistake. Attackers have all the means to compromise legitimate accounts and use them to send requests that seem out of character.
How to Prevent Social Engineering Attacks in Your Business
The key to social engineering prevention lies in employees’ ability to recognize suspicious requests and follow proper security procedures. Businesses can reduce their exposure by combining awareness with appropriate security controls.
1. Train Employees to Recognize Social Engineering
Organizations must conduct regular security awareness training for employees so that they can identify phishing attempts and impersonation tactics. Phishing simulations are also useful for giving employees practical experience in spotting suspicious messages.
2. Verify Sensitive Requests Through Trusted Channels
Organizations should require employees to verify unusual payment requests and changes to banking details. Confirmation should happen through a known phone number or another trusted channel, rather than contact details provided in the request.
3. Improve Email Security
Email security solutions can help detect phishing messages and malicious attachments before they reach employees. It’s important for businesses to configure email authentication controls, such as SPF, DKIM, and DMARC, as these reduce the risk of email spoofing.
4. Implement MFA and Limit Access Privileges
Multi-factor authentication (MFA) adds another layer of protection. However, attackers may still trick employees into approving fraudulent MFA requests. Organizations can use phishing-resistant MFA for stronger protection against credential phishing. Organizations should also limit access privileges, which will help reduce the damage caused by compromised accounts.
5. Monitor Suspicious Activity and Encourage Reporting
Security monitoring can help identify unusual login attempts and any unauthorized activity taking place in the account. Employees should know the procedure to report suspicious messages immediately, so the security team can investigate before further damage occurs.
What Should a Business Do After a Social Engineering Attack?
When a business suspects or confirms a social engineering attack, it should respond quickly to contain the threat and assess the damage.
- Report the Incident: Employees should immediately notify their IT or security team.
- Secure Affected Accounts: Teams need to restrict unauthorized access to avoid further damage. All compromised credentials should be reset, and suspicious sessions should be revoked.
- Preserve Evidence: Retain suspicious messages and relevant security logs for investigation.
- Investigate the Attack: Determine how the attack occurred and identify any affected systems or information.
- Recover and Improve Security: Safely restore affected systems and address the weaknesses that contributed to the incident.
Businesses should also determine whether they are supposed to notify affected individuals or regulatory authorities.
Conclusion
Social engineering attacks remain a serious threat to businesses, even with advanced security tools in place. This is due to the attackers' operating method, which involves sending a convincing message or request that leads to a security breach. However, the risk of such attacks can be reduced with employee awareness and proper verification procedures. Effective security controls are also important in reducing the risk of social engineering attacks.
SafeAeon helps businesses boost their defenses through managed cybersecurity services. Their security tools and team of experts help detect and respond to potential threats, reducing the risk of financial losses and reputational damage.
