Firewalls, patches and encryption protect machines. They do little when a trusted employee types a password into a fake page, approves a login they did not start, or changes a supplier's bank details on request. Phishing still works because it never had to defeat the technology. It only has to persuade one person, once.

People are the target, not the weak point

Social engineering means getting a person to do something that serves an attacker: hand over a password, approve a sign-in, open a file or send money. Phishing is its most common form. A message is dressed up to look genuine, and the recipient acts on it.

It is tempting to treat this as a problem of careless staff. That framing is wrong, and it is costly. Phishing exploits ordinary behaviour that makes organisations run: people respond to managers, help colleagues, meet deadlines and open invoices. Given the right timing and a plausible story, security professionals fall for it too.

The levers are few and well understood:

  • Authority. The message seems to come from a senior manager, a bank, a regulator or the police.
  • Urgency and fear. An account will close, a penalty will apply, trouble is coming.
  • Opportunity. A refund, a prize, a job or an investment, available only for today.
  • Trust and helpfulness. A colleague or supplier asks for a quick favour.
  • Curiosity. An unexpected parcel notice, invoice or shared file.

Every one of them pushes the same way: act now, think later. That is the attacker's real requirement. The defence is the reverse habit. When a message creates pressure, pause, and check it through a separate route you already trust.

The lure has left the inbox

Email is still the familiar channel, with fake sign-in pages, harmful links and attachments that imitate well-known services or the recipient's own organisation. But the lure now arrives wherever people extend trust.

  • Spear phishing is tailored to one person, built from details about their role, colleagues or recent work.
  • Business email compromise impersonates an executive, colleague or supplier, sometimes from a genuine mailbox that has been taken over, sometimes from a look-alike address. The aim is usually a payment or a change of bank details.
  • Smishing and vishing move the same tricks to text messages and phone calls: fake delivery, bank and mobile money texts, and callers posing as bank staff, IT support or officials.
  • Messaging apps and social media carry fake profiles, fake job offers and messages from friends whose accounts have been hijacked.
  • QR codes hide their destination. A person cannot read the address before scanning, and the scan moves them onto a phone that often has weaker protection than a work laptop. Codes can arrive by email, on parcels, or stuck over genuine codes in public places.
  • Multi-factor fatigue, also called prompt bombing, starts after the password is already stolen. The attacker triggers approval request after approval request until the person accepts one to make the noise stop.

The channels differ. The tells are much the same: a request nobody expected, a push for speed, an ask for credentials, codes or money, a sender or link that is slightly off, and a request to skip the usual process or keep it quiet. Display names cost nothing to fake. The full sender address and the real destination of a link say more.

How a phishing attack runs and where it can be stopped: a lure arrives on any channel, a pressure lever pushes for speed, and the attacker asks for a password, code or payment; the defence is to pause and verify through a trusted route, then report quickly. WHERE A LURE CAN BE STOPPED The lureemail · text · call · QR The pressureauthority · urgency The askpassword · code · money The pauseverify by a known route The reportfast, and without blame THE ATTACK NEEDS A QUICK ACT. THE DEFENCE NEEDS A PAUSE
The first three steps belong to the attacker. The last two belong to the institution, and they work only if people feel free to use them.

What AI has changed

For years, staff were taught to look for clumsy grammar and odd spelling. Generative AI has quietly retired that advice. Messages can now be fluent, written in any language and personalised for each target, at volume. AI can also collect and summarise public information about a person, so the story fits their job and their week.

Two newer threats go further. Voice cloning can imitate a familiar voice from a short recording. Deepfake video can put a convincing likeness of a real person into a call or a recorded message.

The lesson is not to get better at judging how a message looks or sounds. It is to stop relying on that judgement at all, and lean on process instead:

  • Verify the request, not the voice. Anything touching money, credentials, bank details or sensitive data is confirmed by calling back on a number you already hold, or through another channel you already trust.
  • No exceptions for rank or haste. Seniority and urgency are exactly what an impersonator borrows.
  • Agree checks in advance, such as code words between executives and finance teams for high-risk requests.
  • Judge the ask. A well-written message is no longer evidence of anything.
An attacker can copy a face, a voice and a writing style. It is much harder to copy a call-back to a number you already had.

Controls that do not depend on anyone noticing

People are one layer of defence. They should never be the only one. The right technical controls stop many lures before anyone sees them, and contain the damage when someone is fooled.

  • Email authentication. Publishing SPF, DKIM and DMARC records makes it far harder to send mail that uses your exact domain. A DMARC policy of quarantine, or more strongly reject, asks receiving systems to treat failing messages as suspicious or refuse them. These records do nothing about look-alike domains, so filtering and checking still matter.
  • Filtering of email and web traffic to block known bad messages, links and attachments, with warnings on external mail and look-alike senders.
  • Phishing-resistant multi-factor authentication. Security keys and passkeys built on the FIDO2 standards use public-key cryptography. Each credential is bound to the genuine site's address, so a fake site cannot use it, and there is no code for anyone to type or read aloud. This matters because some phishing kits sit between the victim and the real site and capture codes and sessions as they are entered. Keep weaker fallback methods to a minimum, since attackers will try to steer people onto them.
  • Number matching and limits on approval prompts, where phishing-resistant methods are not yet in place, to blunt prompt bombing.
  • Least privilege and payment controls. If a payment needs a second approver, one deceived employee cannot move a large sum alone.
  • One-step reporting: a single button or address, with quick feedback.

A culture that reports

The realistic goal is not a workforce that never clicks. It is one that notices, pauses and reports, quickly and without fear. A report in the first minutes can protect everyone else who received the same message. Someone who clicked and says so at once gives the security team time to reset passwords and block the attack. Someone afraid of blame gives that time to the attacker.

For an institution, that means a few deliberate choices:

  1. Thank every report, including false alarms.
  2. Train little and often, with the scams people actually receive, including local ones such as fake mobile money messages and impersonated officials.
  3. Run simulations that teach rather than trap. Avoid cruel lures, such as fake bonuses in hard times, and never use results to shame individuals.
  4. Measure reporting, how many people report and how fast, not only how many click.
  5. Teach the "I clicked, what now?" steps: report at once, change the password from a trusted device, and call the bank or provider on the number from the card or official app if money is involved. Genuine staff will never ask for a one-time code, PIN or login approval. A sudden loss of mobile signal can mean a SIM swap.
  6. Share real attacks the organisation has seen, so the threat feels concrete.

In Kenya, cyber incidents can be reported to the National Kenya Computer Incident Response Team – Coordination Centre (National KE-CIRT/CC), hosted by the Communications Authority of Kenya. Fraud can be reported to the National Police Service and the Directorate of Criminal Investigations.

Our free course Phishing and Social Engineering covers manipulation, the channels, AI-enabled impersonation, technical controls and reporting culture in depth, with a knowledge check and a certificate.

Sources