Cybercriminals do not always need to hack their way into your business.

Sometimes they simply persuade somebody to open the door.

That might mean convincing an employee to reveal a password, approve a Microsoft 365 login, change a supplier's bank details, install remote-access software or transfer money.

This is social engineering.

And it remains dangerous because attackers are exploiting something every organisation needs to function: trust between people.

The answer isn't simply telling employees to “be more careful”.

Businesses need a combination of staff awareness, verification procedures, technical security controls and rapid incident response.

Most importantly, your security should be designed around a realistic assumption:

Eventually, somebody will make a mistake.

Your systems and processes should prevent that single mistake from becoming a major breach.

What Is Social Engineering?

Social engineering is the use of deception, impersonation or psychological pressure to persuade somebody to do something that benefits an attacker.

That might include:

• revealing login credentials
• opening a malicious attachment
• visiting a fake Microsoft 365 login page
• approving an unexpected authentication request
• changing bank details
• transferring money
• disclosing confidential information
• installing software
• granting remote access
• allowing somebody into a restricted building

Attackers frequently impersonate people or organisations the victim already trusts.

That could be a managing director, colleague, customer, supplier, bank, Microsoft, delivery company or even your IT support provider.

Why Social Engineering Works

Most successful social-engineering attacks don't depend on the victim being foolish.

They exploit completely normal human behaviour.

Employees want to:

Be helpful.

Respond quickly.

Follow instructions from senior management.

Keep customers happy.

Fix problems.

Attackers manipulate those instincts using urgency, fear, authority, secrecy and familiarity.

Consider:

“The Managing Director needs this £18,500 payment sent before 4pm.”

Or:

“Microsoft has detected suspicious activity. Your account will be disabled unless you verify it now.”

Or:

“I'm calling from IT. We're fixing a security problem and need you to approve the login notification on your phone.”

Each creates pressure to act before thinking.

The most effective defence is therefore not simply recognising bad spelling.

It is creating business processes where unusual requests are verified regardless of how convincing they appear.

Common Social Engineering Attacks in 2026

Phishing

Phishing emails attempt to persuade recipients to open malicious attachments, visit fraudulent websites or disclose information.

Common themes include:

• Microsoft 365 password expiry
• shared OneDrive documents
• fake invoices
• DocuSign notifications
• voicemail alerts
• account suspension warnings
• delivery notifications
• HR documents

Modern phishing emails can be professionally written and visually convincing.

Poor grammar is no longer a reliable indicator.

Spear Phishing

Spear phishing is much more targeted.

The attacker may know:

• the employee's name
• their job
• their manager
• the company's suppliers
• current projects
• colleagues
• email-address formats

That information can make an attack substantially more believable.

Business Email Compromise

Business Email Compromise, or BEC, targets business processes rather than simply passwords.

An attacker might impersonate:

• a director
• finance manager
• supplier
• customer
• solicitor
• accountant

The objective may be to change payment details or persuade somebody to make an unusual transfer.

A typical request might say:

“We've changed banks. Please use the attached account details for all outstanding invoices.”

If your accounts department changes those details based solely on the email, your email filtering is effectively your final defence.

It shouldn't be.

Vishing

Vishing uses telephone calls.

The attacker might pretend to be:

• IT support
• Microsoft
• a bank
• an insurer
• a supplier
• a senior employee

A convincing voice, caller ID or knowledge of your organisation does not prove somebody's identity.

Smishing

Smishing uses SMS or mobile messaging.

A phone screen also makes it harder to inspect links and sender information carefully.

Employees increasingly use the same smartphones for personal and business communication, giving attackers another route into the working day.

MFA Fatigue

Suppose an attacker has already stolen an employee's password.

They repeatedly attempt to log in.

The employee starts receiving authentication prompts.

Eventually they approve one because they think:

“Maybe Microsoft needs this.”

That is an MFA fatigue or MFA bombing attack.

Microsoft specifically identifies user fatigue and MFA bombing as weaknesses attackers exploit against traditional authentication methods.

The rule should be simple:

Never approve an authentication request you didn't initiate.

Unexpected MFA prompts should be reported immediately because somebody may already know the password.

Fake IT Support

This deserves particular attention.

An attacker contacts an employee claiming to be from IT.

They may already know:

• the employee's name
• company
• Microsoft 365 email address
• IT provider
• device type

They then claim there is an urgent security problem.

They might ask the employee to:

• install remote-access software
• visit a website
• disclose a code
• reset a password
• approve an MFA request

Employees should know how their genuine IT provider normally contacts them and how to independently verify unexpected support requests.

1. Make Verification Part of Normal Business

Verification should not feel rude.

It should be company policy.

Create clear verification procedures for high-risk actions such as:

• supplier bank-detail changes
• unusual payments
• payroll changes
• password resets
• new user creation
• confidential information requests
• remote-access requests

For example, if a supplier emails new bank details, call them using the telephone number already held in your records.

Do not use the number supplied in the same email requesting the change.

For significant payments, consider requiring approval from two authorised people.

The crucial point is:

Verification must use an independent trusted channel.

2. Teach Staff to Challenge Urgency

Social engineering often depends on preventing the victim from thinking.

Create a business culture where employees are allowed to challenge unusual requests—even when they apparently come from somebody senior.

Useful questions include:

Was I expecting this?

Does this follow our normal process?

Why is it suddenly urgent?

Why am I being asked to keep this confidential?

Would this person normally ask me to do this?

Can I verify it independently?

A managing director should expect finance staff to verify an unusual £20,000 transfer.

That procedure protects the director as much as the employee.

3. Use MFA — But Use Strong MFA

Multi-factor authentication remains essential.

But businesses now need to understand that not all MFA is equally resistant to social engineering.

Microsoft warns that conventional methods including SMS codes and push notifications can be targeted through phishing, interception and user fatigue. Microsoft recommends moving towards phishing-resistant methods such as passkeys/FIDO2 and Windows Hello for Business.

Passkeys are particularly important because they don't give an attacker a reusable password or one-time code to steal. Windows and browsers ensure the credential is used for the appropriate service, making passkeys resistant to conventional credential-phishing attacks.

For Microsoft 365 businesses, authentication strategy should increasingly move towards:

Passkeys

Windows Hello for Business

FIDO2 security keys

rather than depending indefinitely on SMS codes.

4. Protect Administrator Accounts First

An attacker compromising an ordinary Microsoft 365 account is serious.

Compromising a Global Administrator account can be catastrophic.

Privileged accounts should therefore receive particularly strong protection.

Administrators should not routinely use privileged accounts for:

• email
• browsing
• ordinary Office work

Use separate administrative identities and require strong authentication.

Microsoft specifically recommends phishing-resistant credentials as part of protecting identities and privileged access.

5. Protect Your Email Environment

Email remains one of the most common routes for social engineering.

Businesses should consider controls including:

• anti-phishing protection
• attachment scanning
• malicious-link protection
• impersonation detection
• external-sender identification
• SPF
• DKIM
• DMARC
• malware protection
• suspicious forwarding-rule monitoring
• sign-in monitoring

No email-security product will block everything.

The objective is to reduce how many attacks ever reach employees in the first place.

6. Apply Least Privilege

Assume somebody's account will eventually be compromised.

What could an attacker do with it?

Employees should have access to what they genuinely need—not every system somebody once thought they might need.

Review:

• Microsoft 365 roles
• SharePoint permissions
• shared mailboxes
• finance systems
• administrative rights
• remote access
• third-party applications
• former employee accounts

If a marketing employee's account is compromised, it should not provide administrative access to the entire Microsoft 365 environment.

Limiting privileges limits the blast radius.

7. Review What Your Business Reveals Publicly

Attackers research their targets.

Your website and social media may reveal:

• employee names
• job titles
• reporting structures
• email formats
• suppliers
• customers
• current projects
• finance contacts
• senior leadership
• travel plans

None of those facts may seem particularly sensitive individually.

Combined, they can create an extremely convincing impersonation.

Employees should also think carefully about what they publish on professional and personal social media.

8. Train Staff Regularly — But Don't Make Training Your Only Defence

Security awareness training is valuable.

One annual PowerPoint presentation isn't enough.

Training should include realistic examples involving:

• Microsoft 365 phishing
• fake invoices
• bank-detail changes
• fake IT calls
• MFA fatigue
• suspicious QR codes
• remote-access requests
• unusual executive requests

Different departments also face different risks.

Finance staff may need additional training around payment fraud.

HR staff handle valuable personal information.

Executives are attractive impersonation targets.

IT staff may be targeted for password resets and privileged access.

But there is an important principle:

Training cannot guarantee that nobody will ever click.

Your technical controls and business procedures need to provide the next layers of defence.

9. Use Phishing Simulations Carefully

Simulated phishing exercises can help employees practise identifying and reporting suspicious messages.

They can also reveal which attack themes are particularly convincing.

But simulations should be educational rather than punitive.

The objective isn't to catch employees out.

It is to improve behaviour.

If employees believe security training exists to embarrass them, you may create exactly the behaviour you don't want:

people hiding mistakes from IT.

10. Make Reporting Extremely Easy

Imagine an employee clicks a phishing link and enters their Microsoft 365 password.

What happens next matters enormously.

If they report it immediately, IT may be able to:

• reset credentials
• revoke active sessions
• investigate sign-ins
• isolate a device
• inspect mailbox rules
• investigate malicious applications
• block indicators
• warn other employees

If they hide it until tomorrow, the attacker receives hours to operate.

Employees need a simple reporting route such as a phishing-reporting button, helpdesk system or clearly communicated IT contact method.

Most importantly:

Employees who make genuine mistakes should feel able to report them immediately.

Speed matters more than embarrassment.

11. Have a “Someone Clicked It” Plan

Every business should know what happens after a social-engineering incident.

Do not invent the response while the attacker is already inside the account.

Your plan should cover scenarios including:

• password entered into phishing site
• malicious attachment opened
• fraudulent MFA request approved
• remote-access software installed
• bank payment sent
• sensitive data disclosed
• unauthorised person allowed into the premises

Depending on the incident, the response could involve IT, management, the bank, insurer, customers, regulators or law enforcement.

The correct response varies by incident.

The important thing is knowing who makes those decisions before an emergency occurs.

12. Protect Physical Access Too

Social engineering isn't exclusively digital.

An attacker can simply walk through a door.

Businesses should consider:

• visitor sign-in
• access-controlled doors
• staff identification
• reception procedures
• locked server/network rooms
• secure document disposal
• visitor escorts

Employees should not feel obligated to hold a secure door open for somebody merely because they look confident and are carrying a laptop bag.

Build Security for When Someone Gets Fooled

This is the most important lesson.

A mature cybersecurity strategy doesn't assume:

“Our employees won't fall for phishing because we've trained them.”

It assumes:

“Eventually somebody will.”

Then it asks what happens next.

Does the attacker get a password but encounter phishing-resistant authentication?

Does the compromised account lack administrator privileges?

Does an unusual payment require independent verification?

Does endpoint protection detect the malicious payload?

Can the employee report the incident immediately?

Can IT revoke the session quickly?

Those layers turn a human mistake from a potential catastrophe into a manageable security incident.

A Practical Social Engineering Checklist

For most SMEs, I would prioritise the following:

1. Train staff regularly using realistic examples.
2. Require independent verification for payment and bank-detail changes.
3. Protect Microsoft 365 with MFA.
4. Start moving towards phishing-resistant passkeys or Windows Hello for Business.
5. Protect administrator accounts more strongly.
6. Configure email security including SPF, DKIM and DMARC.
7. Apply least privilege.
8. Make phishing reporting quick and blame-free.
9. Review publicly available company information.
10. Maintain an incident-response procedure.
11. Review physical access.
12. Test the controls rather than assuming they work.

Social Engineering Is a Business Risk, Not Just an IT Problem

IT can configure email filtering.

IT can deploy MFA.

IT can protect endpoints.

But IT cannot decide whether your finance team should accept bank-detail changes by email.

That is a business process.

Likewise, deciding who can approve payments, who can reset accounts and who can grant remote access involves management as well as technology.

The strongest social-engineering defence therefore combines:

People + Process + Technology

Remove any one of those and attackers have an easier route in.

How Hamilton Group Can Help

Hamilton Group can help businesses build practical protection against social engineering without relying solely on employees spotting every suspicious email.

We can assist with Microsoft 365 security, Microsoft Entra ID, phishing-resistant MFA and passkeys, Conditional Access, email protection, SPF/DKIM/DMARC, endpoint security, cybersecurity awareness training, security monitoring and incident response.

Microsoft itself is moving strongly towards phishing-resistant authentication because traditional MFA methods can still be targeted by sophisticated phishing and social-engineering attacks.

The goal isn't to create a workplace where employees are frightened to click anything.

It is to create one where suspicious requests are easy to verify, mistakes are reported quickly and a single bad click doesn't give an attacker control of the business.

Visit or call 0330 043 0069 to discuss cybersecurity and social-engineering protection for your business.