Social engineering attacks bypass technical security by exploiting human psychology rather than software vulnerabilities. Here are real patterns seen in NZ businesses — not the obvious fake-accent Microsoft support call, but the sophisticated variants that fool experienced staff.
Social engineering is the manipulation of people into taking actions or divulging information that benefits an attacker. It doesn't require any technical capability — it requires understanding of human psychology, organisational dynamics, and the specific context of the target. The most sophisticated social engineering attacks are indistinguishable from legitimate interactions until the damage is done.
The IT Support Impersonation (Internal)
A staff member at an Auckland financial services firm received a Teams message from what appeared to be an account in the company's own Microsoft 365 tenant — "IT Support [company name]." The message explained that there was an urgent security patch that needed to be applied to their computer and asked them to run a script by pressing Windows+R and pasting a command. The staff member complied. The script installed remote access software.
What happened: the attacker had compromised a separate Microsoft 365 account at the firm (via phishing) and changed the display name to "IT Support [company name]." The message appeared to come from inside the organisation. Defence: configuring Microsoft 365 to display "(External)" when messages come from accounts outside verified internal domains — this would have flagged the compromised account's domain as non-internal.
The New Colleague Account Setup
A receptionist at a Wellington accounting firm received a call from someone claiming to be a new employee starting the following Monday. The caller said they needed access to the firm's client portal set up in advance so they could start work immediately. They provided plausible-sounding details (the role, a manager's name obtained from LinkedIn) and asked the receptionist to email them their login credentials directly. The receptionist created the account and emailed the credentials to a Gmail address with the caller's name.
The firm's actual hiring process didn't include this type of direct credential setup — it went through the IT team. The attacker had identified the firm's new hire period through LinkedIn and timed the call accordingly. The control that would have stopped this: all account creation requests must come through an internal manager via the firm's standard process — never via unsolicited external call.
The Urgent Vendor Update
An operations manager at a manufacturing company received an email from what appeared to be their ERP software vendor, explaining that a critical security update needed to be applied immediately and providing a download link. The email used the vendor's real branding, the correct product name, and referenced recent account activity that was accurate (obtained from previous phishing). The manager downloaded and ran the update. It was a remote access trojan.
The defence: any software update request that arrives via email should be verified by going directly to the vendor's website rather than using the provided link, and significant updates should go through the IT team rather than being applied by end users.
Social engineering attacks succeed when they match the context, the channel, and the psychology of the target precisely enough that verification instincts don't trigger. The consistent defence is the same regardless of attack type: verify independently, using channels you initiated yourself, before acting on any unusual request.
