Social Engineering Examples: Real Attacks That Worked

In July 2020, a 17-year-old from Florida convinced Twitter employees to hand over internal credentials. Within hours, the accounts of Barack Obama, Elon Musk, Joe Biden, and Apple were all posting Bitcoin scam messages. The attacker didn't exploit a software vulnerability. He exploited people. These social engineering examples — the real ones that made headlines — reveal how human psychology remains the weakest link in every security chain.

If you're searching for social engineering examples, you're probably trying to understand how these attacks actually work so you can protect your organization. That's exactly what this post delivers. I'll walk through specific, documented incidents, break down the techniques threat actors used, and give you concrete steps to build a defense that actually holds up.

Social engineering bypasses firewalls, endpoint detection, and encryption. It targets the one system you can't patch: the human brain. According to the Verizon 2020 Data Breach Investigations Report, 22% of confirmed data breaches involved social engineering — making it one of the top attack vectors year after year.

In my experience, organizations pour money into technical controls but leave their people completely untrained. That's like installing a vault door and leaving the window open. A threat actor doesn't need a zero-day exploit when they can just ask someone to hold the door.

The psychology behind it is well-documented. Attackers exploit authority, urgency, fear, curiosity, and helpfulness. These aren't personality flaws — they're normal human responses. That's what makes social engineering so dangerous and so hard to eliminate.

The 2020 Twitter breach is one of the most instructive social engineering examples of the past decade. The attacker, Graham Ivan Clark, used phone-based social engineering — specifically vishing (voice phishing) — to convince Twitter employees that he was a colleague from the IT department.

He persuaded them to enter their credentials into a fake internal VPN page. Once he had those credentials, he accessed internal admin tools and took over 130 high-profile accounts. The scheme netted roughly $120,000 in Bitcoin before it was shut down.

The takeaway: even a massive tech company with sophisticated security was vulnerable because employees trusted a voice on the phone. No malware. No code exploitation. Just a convincing story.

The RSA Breach: Spear Phishing with an Excel File

In 2011, attackers sent two small groups of RSA employees an email with the subject line "2011 Recruitment Plan." The attachment was an Excel spreadsheet containing a zero-day exploit. An employee pulled the email out of their junk folder and opened it.

That single action gave attackers a foothold inside RSA's network. They eventually stole data related to RSA's SecurID two-factor authentication products — data that was later used to target defense contractors like Lockheed Martin.

This is a textbook spear phishing example. The attacker crafted a message that looked relevant to the target's job function. Curiosity did the rest.

The Ubiquiti Networks Wire Transfer Fraud

In 2015, Ubiquiti Networks disclosed that attackers used social engineering to impersonate executives and request fraudulent wire transfers from the company's finance department. The scheme — known as business email compromise (BEC) — cost the company $46.7 million.

BEC attacks don't require any technical sophistication. The attacker just needs to know who the CFO is, who handles payments, and how to write a convincing email. According to the FBI IC3 2020 Internet Crime Report, BEC was the costliest cybercrime type, accounting for $1.8 billion in reported losses in 2020 alone.

The Target Breach: Attacking Through a Vendor

The 2013 Target data breach — which exposed 40 million credit and debit card numbers — started with a phishing email sent to an HVAC contractor. The attacker used the contractor's stolen credentials to access Target's vendor portal, then pivoted into the payment processing network.

This is social engineering combined with supply chain vulnerability. The threat actor didn't go after Target directly. They went after the weakest link in Target's ecosystem. Your organization's security is only as strong as the least-trained person with access to your systems — and that might not even be your own employee.

Every one of the social engineering examples above maps to a well-known technique. Here's what I see most often in the wild:

Phishing: Mass emails designed to trick recipients into clicking malicious links or providing credentials. Still the most common initial access vector.
Spear Phishing: Targeted phishing aimed at specific individuals, often using personal details gathered from LinkedIn or company websites.
Pretexting: Creating a fabricated scenario to build trust. The Twitter attacker pretended to be IT support. BEC attackers pretend to be the CEO.
Baiting: Leaving infected USB drives in parking lots or common areas. This still works — studies have shown 45-98% pickup and insertion rates in controlled experiments.
Tailgating: Physically following an authorized person through a secured door. Low-tech, highly effective, almost never tested in phishing simulations.

You can't patch humans, but you can train them. Here's the framework I recommend based on what actually reduces incident rates:

1. Run Realistic Phishing Simulations

Simulations are the single most effective tool I've seen for changing employee behavior. Not once a year — monthly or quarterly at minimum. The simulations should mimic real attack patterns: BEC, credential harvesting, fake invoices, HR impersonation.

Our phishing awareness training for organizations walks teams through realistic scenarios and teaches employees to recognize the red flags before they click.

2. Build a Security Awareness Culture

Training can't be a checkbox exercise. Your employees need to understand why social engineering works, not just what it looks like. When people understand the psychology — authority bias, urgency, reciprocity — they develop an instinct for spotting manipulation.

A strong cybersecurity awareness training program covers more than just phishing. It addresses pretexting, vishing, physical security, and the social engineering tactics that the Verizon DBIR consistently flags as top threats.

3. Implement Multi-Factor Authentication Everywhere

Even when credential theft succeeds — and it will — multi-factor authentication (MFA) stops the attacker from using those credentials. The RSA breach and the Twitter hack both could have been significantly harder to execute with properly implemented MFA.

MFA isn't bulletproof. SIM-swapping and real-time phishing proxies can beat SMS-based MFA. Use hardware tokens or app-based authenticators whenever possible.

4. Adopt Zero Trust Principles

A zero trust architecture assumes every user and device is potentially compromised. No one gets automatic access to anything. Every request is verified. This limits the blast radius when a social engineering attack does succeed.

NIST's SP 800-207 Zero Trust Architecture document is the definitive guide. If your organization hasn't started planning a zero trust migration, 2021 is the year to begin.

5. Verify Out-of-Band for Sensitive Requests

Any request involving money, credentials, or sensitive data should be verified through a different communication channel. If you get an email from the CEO requesting a wire transfer, pick up the phone and call the CEO directly. Not the number in the email — the number you already have.

This one step would eliminate most BEC fraud overnight. Yet in my experience, fewer than 30% of organizations have a formal verification policy in place.

The threat landscape for social engineering is escalating, not stabilizing. Here's why:

Remote work expanded the attack surface. Since 2020, employees working from home are harder to reach for in-person verification and more reliant on digital communication. Attackers know this.

Personal data is easier to harvest. LinkedIn, Facebook, company websites, and data broker sites give attackers everything they need to craft convincing pretexts. A spear phishing email that references your actual job title, your boss's name, and a current project is hard to spot as fake.

Ransomware gangs use social engineering as the entry point. Groups like Ryuk and REvil frequently gain initial access through phishing emails. Once inside, they deploy ransomware that can cripple entire organizations. The average cost of a ransomware attack in 2020 was $4.44 million according to IBM's Cost of a Data Breach Report.

What Should You Do This Week?

Don't wait for a breach to take social engineering seriously. Here's a five-day action plan:

Monday: Audit your current security awareness program. When was the last training? When was the last phishing simulation?
Tuesday: Enroll your team in structured cybersecurity awareness training that covers social engineering techniques in depth.
Wednesday: Review your MFA deployment. Identify every system that still relies on passwords alone.
Thursday: Launch a baseline phishing simulation to measure your organization's current click rate.
Friday: Draft a verification policy for wire transfers, credential resets, and sensitive data requests. Require out-of-band confirmation.

Social engineering examples from real breaches prove one thing consistently: the attack doesn't have to be sophisticated to be devastating. A convincing email, a phone call from "IT support," a USB drive left near the front door — these are the weapons. Your defense starts with people who know how to recognize them.

What Makes Social Engineering So Effective?

Social Engineering Examples from Real-World Breaches

The Twitter Hack: Phone-Based Social Engineering