Social engineering redirection is the act of guiding a target to an attacker-controlled place during an otherwise legitimate-looking interaction. The technique works by replacing trust in the original channel with trust in the attacker’s instructions, which makes the victim part of the attack path.
What Social Engineering Redirection Means in Practice
social engineering redirection is not just persuasion, it is control of the path a person follows. The attacker inserts instructions, links, phone numbers, or workflows that look routine, then steers the target away from the legitimate channel and into attacker control.
The key feature is substitution of trust. The victim still believes they are continuing a normal interaction, but the decision point has been moved to a place the attacker controls, which makes the technique effective across email, phone, chat, web, and help desk workflows.
How Redirection Changes the Attack Path
Redirection works because many business processes depend on users following directions quickly and with limited verification. Once the attacker becomes the source of “next step” guidance, the target may hand over credentials, approve a reset, send money, or disclose sensitive information without recognizing that the channel has changed.
This technique is often paired with impersonation, urgency, or pretexting. The original interaction may begin from a real service, a compromised account, a fake support conversation, or a spoofed notification, but the decisive moment is when the victim is led off the trusted path and into the attacker’s chosen one.
Common Forms of Social Engineering Redirection
Redirection can happen in many ways, but the pattern is consistent: the attacker replaces a legitimate destination with a fraudulent one. That may mean a fake login page, a callback number controlled by the attacker, a counterfeit support workflow, a malicious document portal, or a payment destination that looks operationally valid.
In enterprise environments, redirection frequently targets help desk and account recovery processes because those workflows are designed to help legitimate users regain access. The same pattern also appears in payment fraud, vendor impersonation, shipping or invoice manipulation, and fake identity verification steps that borrow the language of business process.
Why This Technique Is So Effective
Redirection succeeds when trust is inherited from the original context instead of re-verified at the point of action. Users often focus on whether the first message looked believable, while the real compromise occurs later, when they are guided to the wrong place and the attacker captures the resulting action, credential, or approval.
The technique also reduces friction for the attacker. Rather than breaking defenses directly, the attacker leverages normal human cooperation, workflow shortcuts, and time pressure. That makes redirection a durable social engineering pattern even when organizations have strong perimeter controls.
Risk and Threat Considerations
Redirection is risky because it converts a trusted interaction into an attacker-controlled sequence, which can lead to credential theft, fraudulent approvals, account takeover, or exposure of sensitive information. It is especially dangerous when the redirected step sits inside a legitimate business process, such as support, recovery, or payment handling.
Failure mechanism: The victim trusts the legitimacy of the conversation or request, then follows the attacker’s next-step instruction to a fake destination, spoofed channel, or manipulated workflow.
Impact: The attacker gains access, confirmation, or transaction authority that would have been much harder to obtain through direct technical exploitation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Redirection often aims to capture or reset credentials and authenticators. |
| AC-7 — Unsuccessful Logon Attempts | Attackers commonly use redirection to obtain repeated login tries or reset abuse. | |
| AU-6 — Audit Review, Analysis, and Reporting | Redirection attacks are detected by reviewing unusual support, login, or transaction patterns. | |
| Recommendation — Harden credential recovery and rotation flows so redirected users cannot easily hand over valid authenticators. Monitor repeated authentication and recovery attempts for signs of redirected abuse. Correlate help desk, authentication, and transaction logs to spot redirected social engineering paths. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The guidance addresses phishing-resistant authentication and verifier assurance that reduce redirect success. |
| Recommendation — Use phishing-resistant authenticators and strong verifier checks where users may be redirected to a fake destination. | ||
| MITRE ATT&CK | T1566 — Phishing | Redirection is commonly delivered through phishing and related social engineering lures. |
| Recommendation — Map observed lure patterns to phishing techniques and watch for follow-on credential capture. | ||
Practitioner Guidance
What to watch for: Treat any request that moves the user to a new destination, phone number, portal, or recovery step as a separate verification event. That is where redirection often becomes compromise, especially in help desk, vendor, and payment workflows.
Practitioner takeaway: Strong awareness training helps, but redirection is best reduced when the process itself makes the trusted path easy to verify and hard to substitute.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org