Most businesses have a handle on phishing. Staff training covers suspicious emails, dodgy links, and fake invoices. But social engineering attacks go far deeper than inbox threats — and the tactics that fall outside standard phishing awareness are exactly the ones attackers rely on.
If your Manchester business has invested in phishing awareness but not much else, this guide covers what you are likely missing and why it matters.
What Is Social Engineering?
Social engineering is the manipulation of people — rather than systems — to gain unauthorised access, extract information, or trigger a harmful action. It exploits psychology: trust, authority, urgency, fear, and helpfulness.
Phishing is the most common form, but it is one of many. Attackers use social engineering because it is often easier to deceive a person than to break through technical defences. A well-configured firewall does not stop someone from holding the door open for an attacker who has just flashed a fake lanyard.
Pretexting: The Long Con
Pretexting involves an attacker constructing a fabricated scenario to gain trust before extracting information or access. Unlike a quick phishing email, pretexting attacks can unfold over days or weeks.
A common example: someone calls your accounts team posing as an HMRC inspector, a supplier auditor, or a new IT contractor. They already know enough about your business — from LinkedIn, Companies House, or a previous data breach — to sound credible. Over several calls, they build rapport and gradually extract credentials, bank details, or system access.
In Manchester and Sale, financial services firms and professional services companies are frequently targeted this way. The attacker’s research is thorough and their persona is rehearsed.
Vishing: Voice Phishing Is Not Just a Nuisance
Vishing (voice phishing) is telephone-based fraud where the attacker impersonates a trusted party — a bank, IT helpdesk, Microsoft support, or a senior colleague. With AI voice cloning now widely accessible, some attacks now spoof the actual voice of a known individual.
The classic “IT helpdesk” vish involves calling staff and claiming there is an urgent security incident requiring remote access or a password reset. Staff, trained to be helpful and responsive to IT requests, often comply without questioning identity.
Establishing a verification protocol for inbound IT support calls is a basic but underused defence. If someone calls claiming to be from your IT support team, your staff should know exactly how to verify that before acting.
Smishing: SMS as an Attack Vector
Smishing (SMS phishing) has grown significantly as businesses rely more heavily on mobile communication. Attackers send text messages impersonating delivery companies, banks, HMRC, or internal IT systems — often with links to convincing fake login pages.
What makes smishing particularly effective is that mobile devices receive less security scrutiny than corporate laptops. Staff may not be running endpoint protection on their personal phone, and the smaller screen makes URLs harder to inspect. A link that looks legitimate on a desktop is much harder to evaluate on a 6-inch display.
If your business uses two-factor authentication via SMS, smishing attacks can be designed specifically to intercept or social-engineer those codes out of recipients.
Tailgating and Physical Intrusion
Physical social engineering is often dismissed as unlikely, but it happens regularly in business districts across Greater Manchester. Tailgating — following an authorised person through a secure door — requires almost no technical skill and relies entirely on social norms around politeness.
Most people will hold a door open for someone carrying boxes, wearing a high-vis jacket, or confidently displaying a badge. Once inside, an attacker can access unsecured workstations, plug in a rogue USB device, or photograph sensitive documents left on desks.
Visitor management processes, clear access policies, and a culture where staff feel empowered to challenge unfamiliar faces are the primary defences here. It is uncomfortable to ask someone to badge in, but it is necessary.
Baiting: Something for Nothing
Baiting exploits curiosity or greed. The most well-known version involves leaving infected USB drives in car parks or reception areas labelled “Salary Review 2026” or “Redundancy List”. Curiosity does the rest.
Online baiting takes the form of free software downloads, cracked tools, or enticing attachments. The payload is malware or a credential harvester. The damage from a single curious click can spread quickly across a connected business network.
A clear policy on USB devices and unvetted software, enforced through endpoint security controls, removes much of this risk. What staff cannot physically plug in or download cannot hurt you.
QR Code Attacks (Quishing)
QR codes have become a routine part of business life — on restaurant menus, business cards, event check-ins, and marketing materials. Attackers have followed. Quishing involves replacing legitimate QR codes with malicious ones that redirect to credential-harvesting sites or trigger drive-by malware downloads.
It is an effective vector because QR codes are opaque. A person scanning a QR code on a meeting room poster or an invoice has no way of knowing where it actually leads until they are already there. Standard URL inspection habits do not help.
Training staff to be cautious about QR codes in unexpected contexts — and to check the destination URL before entering any credentials — is a simple but frequently overlooked step.
Vendor and Supplier Impersonation
Supply chain social engineering involves attackers impersonating a supplier, contractor, or partner your business already trusts. They may spoof the email domain, clone an invoice template, or intercept an ongoing email thread to redirect a payment.
This is one of the most financially damaging forms of business IT fraud. The request looks legitimate because it appears to come from a real relationship. Invoice fraud via supplier impersonation costs UK businesses hundreds of millions each year.
Dual-authorisation on payment changes, phone verification of account detail updates, and strong email authentication (SPF, DKIM, DMARC) all help. Your IT support partner can audit your current email security posture and close the gaps.
Building a Defence That Goes Beyond Phishing Training
Phishing awareness training is valuable, but it only addresses one vector. A more complete approach to social engineering attacks covers:
- Staff awareness training across all social engineering types — not just email
- Clear verification procedures for inbound calls claiming to be IT, HR, or finance
- Physical access controls and a culture of challenging tailgaters
- USB and removable media policies enforced through endpoint management
- Email authentication (SPF/DKIM/DMARC) to reduce impersonation risk
- Dual-authorisation on financial transactions and bank detail changes
- Regular simulated attacks — including vishing and physical tests — not just phishing simulations
PC Express IT works with businesses across Manchester, Sale, Altrincham, and Trafford to build layered security that accounts for human vulnerability alongside technical controls. If your current training programme only covers phishing, it is time to widen the scope.
Contact our team to discuss a full social engineering risk review for your business.
Frequently Asked Questions
What is the difference between phishing and social engineering?
Phishing is a specific type of social engineering attack delivered via email. Social engineering is the broader category — it includes any technique that manipulates people psychologically to gain access, information, or money, whether via phone, text, in person, or digitally.
How do social engineering attacks start?
Most attacks begin with open-source intelligence gathering. Attackers research your business on LinkedIn, Companies House, your website, and social media before making contact. The more they know about your team, suppliers, and processes, the more convincing their approach will be.
Can AI make social engineering attacks worse?
Yes, significantly. AI voice cloning can now replicate a known colleague’s voice convincingly. AI-generated text removes the spelling errors that once indicated phishing. Deepfakes can impersonate executives in video calls. These tools lower the barrier for attackers and make attacks harder to detect by instinct alone.
How do I train staff to resist social engineering?
Effective training goes beyond telling staff to watch for suspicious emails. It includes role-playing vishing scenarios, clear procedures for verifying caller identity, physical access awareness, and regular simulated attacks across multiple vectors. Training should be ongoing — not a one-off annual session.
What should my business do if a social engineering attack is suspected?
Stop the interaction immediately and do not provide any additional information. Report it to your IT support team and line manager. If credentials or financial details may have been shared, escalate immediately — account lockouts, password resets, and bank notification may all be required within hours.
Is social engineering covered by cyber insurance?
It depends on your policy. Some cyber insurance policies cover social engineering fraud, including invoice fraud and funds transfer fraud, but often as an optional add-on with sub-limits. Review your policy carefully and speak to your broker about whether your current cover addresses social engineering losses specifically.
How can PC Express IT help with social engineering protection?
We provide security awareness training, email authentication setup (SPF/DKIM/DMARC), endpoint security controls, and security audits for businesses in Manchester, Sale, and the wider Trafford area. We can also help you build internal policies for call verification, physical access, and payment authorisation that reduce social engineering risk across your team.
