The most damaging intrusions of recent years did not start with an exploit: they started with a phone call to a help desk, a text message with a login link, or a video call with a convincing fake executive. This list ranks the ten social engineering attacks that most often lead to account takeover, fraud and ransomware, with real incidents, the signals that give each one away and the controls that stop it. Phishing email is item 1 here but has its own list, the Top 10 Phishing Techniques; this page covers the wider set of attacks on people, processes and support channels. It is written for security leads, IT and help desk managers, finance teams and awareness owners. For the psychology and programme design behind these attacks, read the Social Engineering Guide.
Key takeaways
- Identity processes are the target. Help desk resets, MFA enrolment and OAuth app approvals give an attacker a working account without stealing a password.
- Verification must not depend on the caller. Call back on a number you already hold, and never accept face, voice or a supplied number as proof of identity.
- Phishing-resistant MFA removes whole categories. CISA's Scattered Spider advisory calls for FIDO/WebAuthn or PKI-based MFA because it resists push bombing and SIM swaps.
- Money moves on trust, not systems. The FBI's IC3 recorded 21,442 business email compromise complaints and about US$2.77 billion in reported losses in 2024.
- Reporting beats blaming. The NCSC warns that training alone cannot teach everyone to spot every phish; quick, no-blame reporting gives defenders time.
The Top 10 at a glance
| # | Attack | What the attacker gets | MITRE ATT&CK |
|---|---|---|---|
| 1 | Credential phishing email | Passwords, session cookies, malware foothold | T1566.001, T1566.002 |
| 2 | Help desk impersonation to reset passwords or MFA | Full takeover of a chosen account | T1566.004, T1078 |
| 3 | Smishing with fake SSO pages | Credentials and one-time codes in real time | T1566, T1598 |
| 4 | MFA fatigue and code sharing | An approved sign-in on a stolen password | T1621 |
| 5 | Business email compromise and payment diversion | Funds sent to attacker accounts | T1534, T1657 |
| 6 | Deepfake voice and video impersonation | Approved transfers and access | T1566.004, T1598.004 |
| 7 | Fake IT support installing remote access tools | Hands-on control of a device | T1219, T1204 |
| 8 | Vishing users into approving OAuth and connected apps | Persistent API access to SaaS data | T1566.004 |
| 9 | Pretexting through social media and messaging platforms | Malware on personal devices, insider information | T1566.003 |
| 10 | Physical tailgating and baiting | Building access, implanted devices | T1200, T1091 |
The ranking is our judgement of frequency and impact, informed by the incidents linked below and by CISA advisory AA23-320A on Scattered Spider, which uses items 2, 3, 4 and 7 together.
1. Credential phishing email
How it works: an email that imitates a supplier, a service or an internal team sends the user to a fake login page or delivers a malicious attachment. Adversary-in-the-middle kits capture the session cookie as well as the password, defeating one-time codes.
Why it ranks first: the UK Cyber Security Breaches Survey 2025 found phishing was the most common and most disruptive attack, experienced by 85% of businesses that reported a breach or attack. The FBI's IC3 logged 193,407 phishing and spoofing complaints in 2024.
How to stop it: the NCSC's four layers apply: make it hard to reach users (DMARC, SPF, DKIM and filtering), help users spot and report, limit impact (patching, no local admin, MFA) and respond quickly. Phishing-resistant MFA stops session theft at the root. See the Top 10 Phishing Techniques and the AiTM Phishing Guide.
2. Help desk impersonation to reset passwords or MFA
How it works: the attacker researches an employee, often on LinkedIn, then calls the IT service desk posing as that person and asks for a password reset or a new MFA device. CISA's advisory AA23-320A describes Scattered Spider pressuring help desk staff, including at contracted providers, to reset passwords and MFA tokens, enabling takeover in single sign-on environments.
Real incidents: in the MGM Resorts breach the attackers said a ten-minute help desk call led to administrator access in the identity platform; MGM reported an estimated US$100 million impact on adjusted property EBITDAR. Press reporting links social engineering of help desk and account reset processes, including at an outsourced provider, to the Marks and Spencer cyberattack and the Co-op cyber attack.
How to stop it: verify callers with checks that cannot be answered from public sources: a call back to the number in the HR system, a manager's confirmation, or identity verification through a phishing-resistant authenticator the user already holds. Require a second approver for resets on privileged accounts and alert on every MFA reset. See the Vishing and Help Desk Social Engineering Awareness Guide and the Help Desk Social Engineering Incident Playbook.
3. Smishing with fake SSO pages
How it works: text messages that appear to come from IT warn about a password expiry or schedule change and link to a lookalike login page. CISA notes Scattered Spider registering victim-specific domains ending in terms such as "-sso", "-servicedesk" or "-okta".
Real incident: in the Twilio breach, employees received texts linking to fake sign-in pages; a phishing kit relayed usernames, passwords and one-time codes to the attackers in real time, and the wider 0ktapus campaign reached more than 130 organisations.
How to stop it: phishing-resistant MFA (FIDO2 passkeys or security keys) makes captured codes useless because the authenticator is bound to the real domain. Monitor newly registered domains containing your brand, and tell staff that IT never sends login links by text.
4. MFA fatigue and code sharing
How it works: with a stolen password, the attacker triggers push approvals repeatedly until the user accepts one, or calls the user posing as IT and asks them to read out a code (ATT&CK T1621 Multi-Factor Authentication Request Generation).
Real incident: in the Uber breach, an attacker with a contractor's purchased password sent repeated approval requests until one was accepted, then reached other employee accounts and internal tools. The Cisco breach combined voice phishing with MFA fatigue.
How to stop it: enable number matching and sign-in context for push MFA, limit and alert on repeated prompts, and move privileged users to phishing-resistant methods first. See the Phishing-Resistant MFA Guide and the Top 10 MFA Mistakes.
5. Business email compromise and payment diversion
How it works: the attacker uses a compromised or lookalike supplier or executive mailbox to request a change of bank details, an urgent transfer or gift cards, often replying inside a genuine thread.
Why it matters: BEC is the most expensive form of social engineering for most businesses. The IC3 2024 report records 21,442 complaints and US$2,770,151,146 in reported losses. No malware is needed, so technical controls often see nothing.
How to stop it: verify every bank detail change and unusual payment through a second channel using contact details already on file, as the NCSC recommends; require dual approval for new beneficiaries; enforce DMARC on your domains; and flag external senders and lookalike domains. See the Email Identity and BEC Guide.
6. Deepfake voice and video impersonation
How it works: attackers clone a senior person's voice or face from public footage and use it on calls, voice notes or video meetings to approve payments or request access. The FBI warned in May 2025 (PSA I-051525-PSA) of ongoing smishing and AI-generated voice campaigns impersonating senior US officials since April 2025.
Real incident: in the Arup deepfake fraud, a finance worker joined a video call where every other participant was fake, then made 15 transfers totalling HK$200 million. No system was hacked.
How to stop it: never treat recognising a face or voice as authentication. Confirm high-value requests by calling back on a pre-registered number, require a second approver, and route approvals through authenticated systems rather than chat or calls. Treat secrecy and urgency from senior staff as red flags. See the AI-Generated Phishing Defence Guide.
7. Fake IT support installing remote access tools
How it works: the attacker calls, texts or messages through Teams as the IT help desk, often after flooding the user's inbox with spam, and talks them into installing a legitimate remote access tool. CISA lists tools such as ScreenConnect, TeamViewer, Splashtop, ngrok and Tailscale in Scattered Spider intrusions (T1219 Remote Access Tools), and notes that use of these tools alone does not indicate compromise.
How to stop it: application allow-listing that blocks unapproved remote access software, removal of local administrator rights, restrictions on external chat contacts in collaboration platforms, and a published rule that IT will never ask users to install tools from a phone call. See the Callback Phishing (TOAD) Guide.
8. Vishing users into approving OAuth and connected apps
How it works: callers posing as IT walk an employee through a SaaS connected app setup screen and ask for a "connection code", which links an attacker-controlled application to the tenant. The app then exports data through the API without further logins.
Real incident: the ShinyHunters Salesforce data theft campaign used modified data loader apps, sometimes renamed to fit the pretext, to export whole tables; Salesforce itself was not breached.
How to stop it: restrict who can approve connected apps, allow-list approved apps, limit API and bulk export permissions, restrict login IP ranges and alert on large exports. This is an identity problem: the approved app is a new non-human identity with standing access. See the Consent Phishing and Illicit OAuth Grants Guide.
9. Pretexting through social media and messaging platforms
How it works: fake recruiters, journalists, investors or colleagues build rapport on LinkedIn, WhatsApp, Signal or Telegram, then send a "job test", document or link (T1566.003 Spearphishing via Service). The FBI notes attackers moving targets to another messaging platform where a malicious link steals credentials.
Why it matters: these conversations happen on personal devices and accounts outside corporate email filtering and logging, and the payload often lands on a developer's or executive's machine with access to code, keys or wallets.
How to stop it: train high-risk roles (developers, finance, executives) on recruitment and investment lures; run unsolicited "tests" and documents only in isolated environments; reduce the public detail staff post about internal systems, as the NCSC advises for senior staff likely to be whaling targets.
10. Physical tailgating and baiting
How it works: an attacker follows staff through a controlled door, poses as a contractor or delivery driver, or leaves USB devices for staff to plug in (T1200 Hardware Additions, T1091 Replication Through Removable Media).
How to stop it: visitor sign-in and escort rules, badge-controlled entrances with anti-tailgating culture, device control policies that block unknown USB storage and human interface devices, and network access control on wall ports. Test with authorised physical assessments. See the Social Engineering and Physical Penetration Testing Guide.
Detection: what to monitor
| Signal | Source | Attacks |
|---|---|---|
| MFA method reset or new device registered, followed by sign-in from a new location | Identity provider audit and sign-in logs | 2, 3, 4 |
| Bursts of denied push prompts for one user | MFA logs | 4 |
| Newly registered domains containing your brand plus "sso", "okta" or "servicedesk" | Domain monitoring, DNS logs | 1, 3 |
| Bank detail change requests and first payments to new beneficiaries | Finance system, payment approvals | 5, 6 |
| Remote access tools installed or executed outside the approved list | EDR, application control | 7 |
| New connected app authorised or large API export by an app | SaaS audit logs | 8 |
| Help desk tickets for resets on privileged or executive accounts | ITSM records | 2 |
Metrics that show progress: percentage of users, then privileged users, on phishing-resistant MFA; percentage of help desk resets completed with a verified call-back or in-person check; time from a staff report to containment; staff reporting rate for simulated and real lures; payment change requests verified out of band; unapproved remote access tools found per month.
Common failure patterns
- Verification that uses details an attacker can find: date of birth, employee number or manager's name all appear in breaches and on social media.
- Outsourced help desks on weaker rules: CISA notes attackers targeting contracted providers; your reset policy must bind them too.
- Training without process change: staff who spot a fake still have no fast, safe way to verify a payment or report a call.
- Punitive phishing simulations: the NCSC warns against simulations that punish staff; fear reduces reporting.
- MFA everywhere except where it matters: phishable methods left on administrator and finance accounts.
Mapping to frameworks
| Framework | Reference | Attacks |
|---|---|---|
| MITRE ATT&CK | T1566 Phishing (.001, .002, .003, .004); T1598 Phishing for Information; T1621 MFA Request Generation; T1219 Remote Access Tools; T1534 Internal Spearphishing; T1657 Financial Theft | 1 to 9 |
| NIST SP 800-53 Rev. 5 | AT-2 Literacy Training and Awareness; IA-2 Identification and Authentication; IA-12 Identity Proofing; AC-2 Account Management; CM-7 Least Functionality | All; 2 to 4; 2; 8; 7 |
| NIST CSF 2.0 | PR.AT-01 personnel provided with awareness and training; PR.AA-03 users, services and hardware are authenticated; DE.CM-03 personnel activity monitored | All; 2 to 4; 2 to 8 |
| CISA AA23-320A | Phishing-resistant MFA, application control, remote access governance | 2, 3, 4, 7 |
Where to start
- This week: write a help desk verification standard for password and MFA resets, including call-back to known numbers and manager approval for privileged accounts; apply it to outsourced desks.
- This month: enable number matching, alert on MFA resets, and move administrators and finance staff to phishing-resistant MFA.
- Within a quarter: enforce out-of-band verification and dual approval for payment changes; block unapproved remote access tools; restrict connected app approvals.
- Ongoing: run role-based awareness for help desk, finance and developers; make reporting one click with feedback; test with authorised social engineering exercises.
Practitioner checklist
- Help desk reset procedure verifies identity with information an attacker cannot look up, and binds outsourced providers.
- Phishing-resistant MFA for administrators, finance and help desk staff first, then everyone.
- Push MFA uses number matching; repeated prompts and MFA resets raise alerts.
- Payment and bank detail changes verified out of band and dual-approved.
- No approval based on recognising a face or voice; high-value requests confirmed on pre-registered numbers.
- Unapproved remote access tools blocked; users lack local admin rights.
- Connected app and OAuth approvals restricted to admins, with allow-lists and export alerts.
- DMARC enforced on your domains; lookalike domain monitoring in place.
- One-click, no-blame reporting with feedback to the reporter.
- Visitor and USB device controls tested by authorised physical assessments.
Standards and references
- CISA: Advisory AA23-320A, Scattered Spider
- NCSC: Phishing attacks, defending your organisation
- FBI IC3: Internet Crime Report 2024
- FBI IC3: PSA I-051525-PSA, Senior US Officials Impersonated
- UK Government: Cyber Security Breaches Survey 2025
- MITRE ATT&CK: Phishing
- MITRE ATT&CK: Multi-Factor Authentication Request Generation
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Social Engineering Guide · Top 10 Phishing Techniques · Vishing and Help Desk Social Engineering Awareness Guide · Phishing-Resistant MFA Guide