Social engineering training for employees: practise the conversation, not just the email

Social engineering is the use of deception to manipulate a person into doing something that helps an attacker, such as making a payment, sharing a code or granting access, usually by pretending to be someone they trust. Good social engineering training for employees goes beyond spotting suspicious emails. It teaches staff to recognise the pressure tactics, gives them safe words to use when challenged, and lets them practise holding the line in a back-and-forth conversation.

What is social engineering?

Social engineering is an attack on human judgement rather than on software: the attacker gets what they want because someone helpful agreed to give it to them. Phishing emails are the best-known form, but the same trick runs over phone calls (vishing), text messages, chat apps and video calls. Our guide to spear phishing vs phishing explains how the channel-based names fit together.

Most workplace attacks rely on pretexting: the attacker invents a believable role and story, the pretext, that makes an unusual request feel normal. “I'm from IT, we're seeing odd sign-ins.” “We've changed banks.” “I'm the new starter in accounts.” The request is the payload; the story is the delivery.

Which psychological levers do social engineers pull?

Social engineers rely on a small set of normal human instincts, and almost every attack uses two or three of them at once. Naming them helps people notice the feeling of being pushed.

A useful rule of thumb: if a message makes you feel rushed, flattered, frightened or reluctant to question someone important, that feeling is the signal. Slow down at exactly that moment.

What are the most common social engineering examples at work?

The most common workplace pretexts are ordinary business roles that come with a plausible reason to ask for money, access or data. These six cover most of what small teams see.

• The supplier changing bank details. A known supplier, or someone using their hijacked mailbox, says they've moved banks. This is the classic route to invoice fraud and payment diversion.
• The IT helpdesk. A caller or chat message says your account is at risk and asks for a sign-in code, a password reset or remote access to “fix” it.
• The new starter. Someone claims to have just joined and asks for access, a shared drive link or a colleague's contact details. People help newcomers without thinking.
• The auditor or inspector. An official-sounding request for staff lists, payroll records or client data, framed as a compliance deadline.
• The recruiter. A friendly approach about a job that leads to “please fill in this form” or “open the job description”, often aimed at staff with system access.
• The CEO who is travelling. A director is “at the airport” or “in back-to-back meetings” and needs a payment or gift cards sorted quietly. This overlaps with business email compromise.

Why does AI make social engineering harder to spot?

Generative AI removes the effort and the tell-tale mistakes that used to give social engineers away, and lets them hold many convincing conversations at once.

• Fluent writing. Poor spelling and odd phrasing are no longer reliable clues. Messages read like a competent colleague wrote them. More in how to spot AI-written phishing emails.
• Any language. Attackers can write natural, local-sounding messages in languages they don't speak.
• Voice clones. A short clip of someone speaking can be enough to imitate their voice on a call. We cover this in voice clones and deepfake CEO fraud.
• Chat at scale. Tools can run dozens of threads at once, replying instantly and adjusting tone when someone hesitates.

The result is that the first message is often unremarkable. The danger shows up in the second, third and fourth messages, when the attacker answers your questions smoothly and starts to lean on you.

Why doesn't traditional awareness training build the skill?

An annual video followed by a multiple-choice quiz teaches people facts about social engineering, but it doesn't give them practice at refusing a real person under pressure.

Knowing that “urgency is a red flag” is easy in a quiz. Applying it is hard when a polite, confident supplier has an answer for every question and mentions your managing director by name. Most people are wired to be helpful and to avoid seeming rude or obstructive, especially to someone senior.

Traditional training also tends to stop at the first message. It asks “is this email suspicious?” and never asks “what do you say when they reply?” Yet that reply is exactly where many payments get approved. And once a year is simply too infrequent for a habit to stick.

What does good social engineering awareness training look like?

Good social engineering awareness training is short, frequent and practical: it gives people words to say, rules to lean on and a safe place to rehearse.

Rehearse the whole conversation

Practise the follow-ups, not just the opening message. Staff should experience an attacker who reassures, changes channel, name-drops a director and gets a little cross, and should feel what it's like to stay polite and firm through all of it.

Give people safe scripts

Scripts take the awkwardness out of saying no. Agree a few phrases as a team so nobody has to invent them on the spot:

• “I'll call you back on the number we have on file.”
• “Bank detail changes have to be confirmed by phone. It's our standard process.”
• “I can't share codes or passwords with anyone, including IT.”
• “I'll need to check this with [manager] first. I'll come back to you.”
• “I'm not able to do that over chat. Please send it through the usual route.”

Notice that none of them accuses the other person. Blaming “the process” lets staff refuse without a confrontation, and a genuine caller won't mind.

Give explicit permission to say no to seniority

Owners and directors should tell staff, out loud and in writing, that they will never be in trouble for checking a request that appears to come from them. Better still, say you'd be disappointed if they didn't. Without that permission, authority wins almost every time.

Write down your verification rules

Rules beat judgement under pressure. A one-page checklist is enough:

1. Any change of bank details is confirmed by phone on a number you already hold, never one from the message.
2. New or unusual payments need a second person to approve, whoever asked for them.
3. Nobody shares sign-in codes or passwords, ever, with anyone.
4. Access requests go through one named person, not whoever is asked first.
5. Requests for secrecy are a reason to check, not a reason to skip checking.
6. Anything odd gets reported straight away, without blame. The NCSC's phishing guidance advises organisations to “avoid creating a punishment or blame-oriented culture” (NCSC).

Example: a fake supplier who pushes back twice

This made-up chat shows what a social engineering conversation looks like when the employee uses the scripts. Watch how the attacker changes tactic each time they hit a rule.

If Dan were genuine, the call to the office number would sort it out in two minutes. Because he isn't, the conversation simply stops. That is what success looks like: not catching the criminal, just giving them nothing.

How can your team rehearse these conversations?

The simplest way to rehearse social engineering is to role-play it: one person plays the attacker, another plays the employee, and the attacker is told to push back at least twice.

Ten minutes in a team meeting is enough. Pick one pretext from the list above, use the scripts, then swap roles. Talk about which push felt hardest. It's usually the senior name-drop.

If you'd rather not run role-plays yourself, Lureproof includes a live-attack simulation as one stage of its monthly assessment. It's a branching practice chat with a social engineer, such as a “supplier” changing bank details who pushes back when challenged. At each turn the employee chooses one of three or four replies, and the conversation branches depending on what they pick. Every message is pre-written by our team; it isn't AI. Answers are scored, and passing means giving the attacker nothing. The monthly assessment is on our Team and Business plans; our free lessons are open to anyone.

FAQ