A message from your “team lead” asks you to approve a sign-in prompt before a meeting. You didn’t try to sign in. Deny the prompt, then contact your team lead through a channel you already use—not by replying to the message. That pause keeps a familiar name and a deadline from becoming access to your account.
Social engineering means manipulating someone into disclosing information, approving access, sending money, installing software, or making an exception to a normal process. The request might arrive by email, text, phone, chat, a collaboration tool, or in person. It doesn’t need a technical vulnerability to work. It needs someone to believe the action is routine, helpful, or too urgent to check.
Recognize the request, not just the wording
Typos can be a warning sign, but a polished message can be fraudulent too. An attacker might use a real colleague’s name, mention a current project, or send from a compromised account. Focus on what the message asks you to do. Does that action fit your normal workflow?
- Pressure or secrecy: “Do this before the meeting” or “Don’t involve the help desk” discourages a second check.
- An unexpected change: A new payment destination, unfamiliar way to share documents, or sudden request for an account recovery code deserves verification.
- A trust shortcut: Someone claiming to be IT, a recruiter, a customer, or a senior manager asks you to skip the usual approval process.
- A mismatched action: A supposed invoice requires you to sign in to an unfamiliar service, or a support call asks you to approve a login you didn’t start.
None of these signs proves a message is malicious. Real requests can be urgent, and malicious ones can sound calm. Treat the signs as reasons to verify, not as proof either way.
Use an independent route to verify
Keep the request separate from its proof. Replying to a suspicious email, calling a number in it, or opening a link supplied by the caller leaves you in the same untrusted conversation. Instead, open the service through a saved bookmark or a known address you enter yourself. For a workplace request, use your company directory or a number you already know.
Suppose a chat message appears to come from a colleague asking you to share a private repository with an external account. Start a new chat from your established contacts, or ask in the project’s usual approval channel. Check the details as well as the sender: which repository, which account, what access level, and for how long? “Is this you?” may not settle whether the colleague actually requested that particular change.
Match the verification to the risk. Reading a public document needs little friction. Granting administrator access, changing bank details, sharing confidential files, or approving a password reset calls for the documented approval path—and a second person if your organization requires one. If the requester wants you to bypass that process, stop.
What to check before opening a link or attachment
Check where a link actually leads, not just the text you can see. On a desktop, hovering may reveal the URL; on a phone, a long press may show it, though interfaces vary. Look carefully at the domain and where it ends. A company name buried in a long address doesn’t make the destination the company’s site. And a correct-looking address doesn’t prove the message is legitimate if the sender’s account has been compromised.
If a notification concerns an account, go to that account directly rather than following the message link. Confirm an unexpected file through an independent channel before opening it. Don’t enable macros, install a viewer, or run a command just because an attachment says you must do so to read it.
Protect the accounts attackers try to reach
Account safeguards can limit the damage if a message fools someone. Use a unique password for each important account and keep it in a reputable password manager. Turn on multifactor authentication where available. Phishing-resistant options such as passkeys or security keys protect against fake sign-in pages better than one-time codes. Still, never share a recovery code or approve a prompt you didn’t initiate.
Keep recovery options up to date. An old email address or phone number tied to an account can become a weak point; an unexpected recovery notification may mean someone is trying to get in. After a suspicious sign-in alert, use your normal route to the service’s settings and review active sessions and connected apps.
For developers, the target may be a code-hosting account, package registry, cloud console, or team chat rather than a personal inbox. Keep permissions narrow. Use separate accounts or roles when appropriate, give collaborators only the access they need, and follow your team’s review process for new integrations. If someone is persuaded to approve access, limited permissions can contain the impact.
Make safe behavior practical at work
People are more likely to bypass checks when the legitimate process is unclear or slow. Teams should make it easy to find out where to report suspicious messages, who approves access changes, and how payment-detail changes are confirmed. Managers can help by welcoming a verification call rather than treating it as a challenge to their authority.
Useful workplace safeguards include:
- Known approval channels: Record access grants and payment-detail changes in the normal system, not only in a private message.
- Least privilege: Limit who can make high-impact changes and review access when roles change.
- Out-of-band confirmation: Verify unusual requests using contact information established before the request arrived.
- Easy reporting: Give staff a clear way to report a suspicious message without fear of blame.
Training is more useful when it teaches people how to make these decisions instead of asking them to memorize suspicious phrases. Discuss realistic examples without asking staff to open dangerous attachments or investigate an attacker themselves. The aim is a repeatable pause-and-verify habit, not perfect intuition.
If you already responded
Act even if you aren’t sure the request was fraudulent. If you entered a password on an unfamiliar page, change it through the real service and anywhere else you reused it. Revoke active sessions if that option is available, check recovery settings and connected apps, and alert your organization’s security or IT contact promptly. Treat the account as potentially compromised if you approved an unexpected sign-in prompt or shared a one-time code.
If you downloaded a file but haven’t opened it, don’t open it to “check.” Report it through your organization’s process. If you ran a file, installed software, or granted remote access, stop using the device for sensitive work and contact IT for advice on containment and inspection. Keep the messages and logs: the original request, its time and sender details, and the actions you took can help responders assess what happened.
For a payment or data-sharing mistake, notify the relevant organization immediately through a known channel. Give a concise timeline of what was requested, what you did, which account or files were involved, and when. Prompt, accurate reporting gives responders more options than waiting quietly to see what happens.
A short verification routine
When a request involves credentials, money, sensitive data, software installation, or a permission change, work through these steps:
- Pause: Don’t act from the notification itself, even if it claims an imminent deadline.
- Identify the action: State exactly what would change if you complied.
- Check independently: Reach the person or service through a previously trusted route.
- Follow the normal process: Use required approvals and record the decision.
- Report a mismatch: If the requester can’t confirm the details, stop and flag the message.
If a message claims your cloud account will be disabled unless you approve a sign-in prompt, deny any prompt you didn’t start. Open the cloud account through your usual bookmark and check its notifications there. If the warning isn’t present, send the original message to your organization’s reporting channel without clicking its link.
