Social engineering is one of the most effective tools in a hacker's playbook - and it doesn't require any technical skill to work. It simply relied on tricking people. In cyber security terms, social engineering is the act of manipulating individuals into handing over confidential information, clicking malicious links, or granting unauthorised access to systems.
In this blog, we'll break down what social engineering is, why it's a growing threat, and what happens when SMEs don't factor it into their cyber security strategy - using real-life examples.
Social engineering attacks are based on psychological manipulation - tricking people into doing something they shouldn't, like clicking a dodgy link or giving up a password.
The most common types include:
These attacks work not by cracking systems, but by exploiting human behaviour: trust, urgency, or fear. Even the most cautious employees can fall for a cleverly crafted ruse.
For SMEs - especially in cities like Manchester - social engineering is a serious threat. And it's on the rise.
Even if your business has antivirus software and firewalls, none of that will protect you if someone on your team is fooled by a convincing email or phone call.
Let's look at how these attacks have played out in real scenarios:
An employee at a UK energy firm received a call from what sounded exactly like their CEO. The voice requested a £200,000 transfer to a supplier. The employee complied, only to later discover the call had been faked using AI voice cloning. The attackers deepfaked the CEO's voice and pulled off a highly convincing fraud.
Both tech giants fell for a phishing scam where attackers posed as a real hardware supplier and sent fake invoices. Over $100 million was paid out before the fraud was discovered.
In 2020, hackers used social engineering to gain access to Twitter's (now X) internal tools by pretending to be IT support. Once in, they hijacked high-profile accounts. The breach wasn't caused by a system flaw - it was a manipulated employee.
And it's not just large organisations who have been hit - here's a few examples of companies just like yours; and we've dealt with them:
An accounts clerk at a Manchester-based construction SME (around 50 staff) received an email apparently from the MD requesting urgent payment to a supplier to secure materials. The tone and email signature matched previous emails. They transferred £22,000. It was only when the real MD walked in a few minutes later that they realised something was wrong.
Lesson: There was no internal payment verification procedures. After the incident, they introduced a simple two-step sign-off process for payments, and trained their staff in spotting phishing emails.
A 30-person North West-based law firm received a phishing email that looked like a Microsoft 365 attempted login prompt. One solicitor entered their password, which gave the attackers access to sensitive client files. The criminals then sent fraudulent emails to clients requesting payment to a new bank account.
Cost: Over £75,000 was lost before the fraud was caught. Several clients left, citing loss of trust. The firm took six months to recover.
At Apex Computing, we believe the best protection is a layered approach: combining employee awareness, smart processes, and strong technology.
Training your team is your first line of defence. We use KnowBe4, a leading platform for interactive security training and phishing simulations. Our clients see real improvement - staff stop clicking suspicious links, and start reporting them instead.
"Criminals are using social engineering to greater effect... education is essential," says our MD, Daniel.
We can run fake phishing tests to see who clicks - without risk - and use the data to tailor your team's training. This turns your workforce into a human firewall.
We help you put in place clear rules and processes. For example, any email requesting a payment or password reset should trigger a verification step - like a phone call or second sign-off.
We offer managed endpoint protection, email filtering, and multi-factor authentication. These tools catch suspicious activity before it causes harm.
We can guide your business through the Cyber Essentials (or Plus) certification process - helping you meet government standards and win trust with clients.
We work with SMEs across Greater Manchester acting as a support who isn't just there to sell software; we become your cyber security partner. Our Apex Cyber Security Sphere bundles together training, monitoring, detection, endpoint protection, and advisory support - all managed by our in-house team.
Whether you're unsure if your team would spot a phishing email or you've already experienced a scare, we'll work with you to tighten your defences without the jargon.