social engineering
A manipulation technique used to deceive individuals into divulging confidential information, granting unauthorized access, or performing actions that compromise security. Not a standalone federal crime, but a method employed to commit offenses under statutes such as the Computer Fraud and Abuse Act.
Definition
Social engineering is a deceptive technique in which a perpetrator manipulates a person into divulging confidential information, providing credentials, or granting unauthorized access to systems or facilities. Rather than exploiting technical vulnerabilities in computer systems, social engineering targets the human element of security by tricking individuals into making security mistakes or giving away sensitive information.
In the federal criminal-law context, social engineering is typically not charged as a standalone offense but serves as the method by which other crimes are committed. The most commonly applicable federal statute is the Computer Fraud and Abuse Act (CFAA), codified at 18 U.S.C. § 1030, which criminalizes unauthorized access to protected computers and systems. When social engineering techniques result in financial losses, identity theft, or unauthorized access to networks, federal prosecutors may pursue charges under the CFAA, federal fraud statutes, wire fraud provisions (18 U.S.C. § 1343), or identity theft laws (18 U.S.C. § 1028).
Common social engineering tactics include phishing, in which fraudulent emails or messages impersonate legitimate entities to harvest credentials; pretexting, where the attacker creates a fabricated scenario to extract information; and vishing (voice phishing), which uses telephone calls to manipulate victims. The FBI's Internet Crime Complaint Center has identified these techniques as primary methods used by cybercriminals to gain access to financial accounts, corporate networks, and personal data.
The criminal exploitation of social engineering has become increasingly sophisticated, with attackers often combining publicly available information from social media and data breaches to craft convincing pretexts. Business email compromise schemes, which frequently employ social engineering to impersonate executives or vendors, have resulted in billions of dollars in losses. Federal law enforcement treats social engineering-based crimes as serious offenses, with penalties varying based on the underlying statute violated, the amount of loss caused, and the number of victims affected.
