Social engineering is a psychological manipulation technique used by attackers to trick individuals into divulging sensitive information. Instead of exploiting technical vulnerabilities, it targets human weaknesses such as trust, fear, or urgency.

Manipulates Human Behavior – The attacker impersonates a trusted entity (a bank representative) to deceive the employee.

Leads to Unauthorized Information Disclosure – The employee unknowingly provides sensitive financial data.

Results in Fraud – The stolen information is misused, causing financial loss.

A. Shoulder Surfing – This occurs when an attacker physically observes someone entering sensitive data (e.g., watching a person type a password).

B. Pharming – This involves redirecting users to a fraudulent website to steal their credentials, not direct impersonation.

C. Phishing – This is a broad category of social engineering that typically involves emails or fake websites, whereas this scenario describes a direct impersonation attack.

IIA’s GTAG on Cybersecurity – Discusses social engineering as a key risk for organizations.

NIST SP 800-61 (Incident Handling Guide) – Identifies social engineering as a common attack vector.

COBIT 2019 (IT Governance Framework) – Highlights human-related cybersecurity risks.

Why Social Engineering is the Correct Answer?Why Not the Other Options?IIA References: