Social engineering is when an attacker persuades a member of staff to hand over access or money by exploiting trust, fear or urgency, instead of breaking into a system. Phishing, spear phishing and AI voice cloning are all forms of it.

These attacks target a person rather than software, so the fix is a written verification process, not more vigilance. Training helps people follow that process, but it cannot replace it.

Most businesses picture a cyber attack as someone breaking through a firewall. More often, someone just asks. A message, a phone call or a visitor at reception persuades a member of staff to switch off a control the business has already paid for.

What is the difference between phishing, social engineering and spear phishing?

They overlap, but the difference is how targeted and how personal the approach is.

Phishing is a message sent at volume asking someone to hand over a password, approve a payment or open a file. It is cheap to send and it is now well written. The Cyber Security Breaches Survey, published by the Department for Science, Innovation and Technology (DSIT), has consistently named phishing as the most common type of attack on UK businesses.

Social engineering is the wider term. It covers any approach where the target is a person rather than a system: a call asking for a password reset, someone with a lanyard and a clipboard at reception, or a “supplier” asking to update their bank details. No software is exploited. The attacker only needs someone to stand a control down.

Spear phishing is phishing aimed at one person or a small group, written from your own public information. It uses the right names, the right supplier and a live project. It is usually aimed at the handful of people who can move money or grant access.

What does a real social engineering attack look like?

In October 2026, ASOS told customers that an unauthorised party had gained access to an employee account by impersonating a trusted contact to obtain login credentials.

Those credentials were then used to reach information on third-party platforms ASOS uses. ASOS said some customers’ names and contact details were exposed, but no payment card information or account passwords. As of 12 October 2026, its investigation is ongoing.

What it shows is how little the first step needs. According to ASOS, the first step was a person being persuaded to hand over a login. ASOS hasn’t said how the contact was made, and this isn’t a comment on its controls. It is a clear example of the pattern this post describes: the attacker started with a person, not a piece of software.

Identity checks before a password is shared or reset are designed to catch this kind of request, and multi-factor authentication limits what a stolen password can do.

What does AI voice cloning change?

AI voice cloning is software that copies how a specific person sounds from a recording of their voice. Attackers use it to phone someone who can move money and sound like a director or a known supplier.

“I recognised their voice” used to be a reasonable reason to trust a call. It no longer is, because public recordings such as conference talks, webinars and videos can give the software enough to work with.

The call is timed for a moment when a fast decision looks reasonable: an urgent payment, or a supplier chasing before the end of the month. Nobody has to be careless for this to work. The call sounds right, the context fits, and the request feels normal.

Why does "be more careful" not work?

 Because it asks people to out-judge an attacker under pressure, and the attacker has had time to prepare. Telling staff to be vigilant puts the whole burden on one person at the worst possible moment. It also gives staff nothing to check a request against, so a convincing request wins by default. 

What should a supplier bank-details process look like?

This is the most useful process to write down, because the loss is usually direct cash. It should include:

• A call-back on a number you already hold, never one supplied in the request, for any change of bank details.
• Verification once, out of band, after which the details are locked and any change goes through the same check.
• Dual authorisation above an agreed payment threshold.
• Named approvers, so everyone knows who is allowed to say yes.
• A standing rule that urgency is a reason to slow down, not to speed up.

Write it down and make sure the finance team has seen it. If money is lost, it is hard to recover without evidence that a process existed.

Where does awareness training fit?

Training matters, but it works as support for a procedure. It teaches people to recognise the pattern, and it turns the rules above into habits. On its own, it leaves staff knowing what a scam looks like with nothing to do about it when one arrives. The two together are what work.

The National Cyber Security Centre (NCSC) publishes free phishing guidance for businesses, and UK Finance runs the Take Five to Stop Fraud campaign.

Where can I find out how exposed we are?

entrustIT’s free guide, Cyber security is a running cost, not a crisis, was written by our CTO, Matthew Dodd, for the person who signs off the budget. It sets out the six threats that reach UK businesses, what they cost when they land, and twelve questions to put to whoever runs your IT. 

FAQs

What is social engineering?
Social engineering is when an attacker persuades a member of staff to hand over access or money by exploiting trust, fear or urgency, instead of breaking into a system. Phishing, spear phishing and voice cloning are all forms of it.

What is the difference between phishing and spear phishing?
Phishing is a generic message sent to many people. Spear phishing is written for one person or a small group, using real names, suppliers and projects, which makes it harder to spot.

Can AI really clone someone’s voice?
Yes. Voice cloning software can copy how a person sounds from recordings of their voice. A familiar voice on a phone call should not be treated as proof of identity for payments or access.

What is the best defence against social engineering?
A written verification process that doesn’t rely on judgement under pressure, such as call-backs on known numbers, dual authorisation above a threshold and identity checks before password resets.

Is staff awareness training enough?
No. It helps people follow a procedure and recognise common patterns, but it works best alongside a written process and technical controls like multi-factor authentication.