Social Engineering Tactics
How attackers manipulate people.
Social Engineering Tactics is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Social Engineering
Social engineering is the art of manipulating people into giving up confidential information or taking unsafe actions.
Instead of hacking computers, attackers hack human trust. It is often the easiest path into an organization.
Why People Are the Target
Firewalls and encryption protect machines, but humans make decisions under pressure.
- People want to be helpful
- People fear getting in trouble
- People trust authority and routine
Attackers exploit these natural instincts.
Pretexting
Pretexting means inventing a believable story (a pretext) to gain trust.
An attacker may pretend to be from IT support to ask for your password.
Caller: 'Hi, this is IT support.
We detected an issue with your account.
Can you confirm your password so we can fix it?'Baiting
Baiting lures victims with something tempting.
- A USB drive labeled 'Salaries 2026' left in a parking lot
- A free movie download that hides malware
Curiosity leads the victim to infect their own machine.
Quid Pro Quo
Quid pro quo means 'something for something'. The attacker offers a benefit in exchange for information or access.
Example: a fake support agent offers to fix a slow computer if you install their remote tool.
Tailgating
Tailgating (or piggybacking) is a physical attack. The attacker follows an authorized person through a secure door.
Carrying boxes or pretending to be on a phone call makes others hold the door open out of politeness.
Authority and Urgency
Two of the most powerful triggers attackers use:
- Authority - pretending to be a CEO, police, or auditor
- Urgency - 'Act now or your account will be locked'
Pressure stops people from thinking critically.
Reciprocity and Liking
People return favors (reciprocity) and say yes to those they like.
An attacker who is friendly, gives a small gift, or shares a common interest builds rapport that lowers your guard.
Dumpster Diving and OSINT
Before an attack, criminals gather information.
- Dumpster diving - searching trash for documents
- OSINT - collecting public data from social media and websites
This research makes their pretext far more convincing.
Impersonation
Impersonation is pretending to be someone trusted: a vendor, a new employee, or a delivery driver.
A fake badge or a confident attitude can be enough to walk into a building unchallenged.
Defending the Human Layer
The best defense is a healthy skepticism.
- Verify identity through a known channel
- Never share passwords, even with 'IT'
- Slow down when you feel pressured
If something feels off, it probably is.
Quick Check
Test your understanding of social engineering tactics.
Recap
You learned how attackers manipulate people:
- Pretexting, baiting, quid pro quo, tailgating
- Triggers: authority, urgency, reciprocity, liking
- Recon via dumpster diving and OSINT
Awareness and verification are your strongest defenses.
Frequently asked questions
Is the “Social Engineering Tactics” lesson free?
Yes — the full text of “Social Engineering Tactics” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Social Engineering Tactics”?
How attackers manipulate people. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Social Engineering Tactics” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Social Engineering Tactics
- Recognizing Phishing
- Vishing and Smishing
- Building Security Awareness