How to identify and prevent the most prevalent cyber scam

How does social engineering fraud happen?

Social engineering fraud originates with scammers harvesting personal data about your employees, vendors, or customers. Then, they use these details to create a convincing impersonation of an individual your employees trust—with the aim of tricking your team into disclosing sensitive information or clicking on malicious links.

Social engineering fraud is not a single tactic; it is a broad strategy that encompasses a range of techniques, including phishing and account takeovers. The 2026 AFP Payments Fraud and Control Survey Report, underwritten by Truist, shows that scammers use a wide array of SEF tactics. Business email compromise (BEC) is the most prevalent, accounting for 70% of all SEF incidents—whether attempted or completed.^{Disclosure 3}

Everyone in your organization can be a target of SEF. This type of attack can be directed at one or two key players or a whole team.

Good news: Cybersecurity awareness training really works.

Three months of cybersecurity training has been shown to reduce the risk of social engineering attacks like phishing by over 40%—with susceptibility dropping from 86% down to just 4.1% after a year of employee training.^{Disclosure 5}

If personal information is stolen in a SEF attack, quickly address the data breach and disclose to partners what you’re doing to mitigate their financial and reputational damage and to improve safeguards around their information.^{Disclosure 6} Also, let them know how they can help you keep their information safe.

Customers appreciate proactive, transparent communications about data breaches.

Best practices and prevention

Preventing losses from social engineering fraud starts with you—and the processes you put in place to protect your company. Here are several strategies that can help your employees spot and avoid social engineering scams.

Implement a workplace education program.

Train your team to recognize and report suspicious messages, attachments, and links. Create protocols for identifying red flags, reinforce these trainings regularly, and implement programs for new hires.

Run attack simulations on your team.

Regularly expose staff to the latest social engineering scam methods and malware in a safe way through mock attacks performed by your IT team. They can trace who fell for tactics like spear phishing or vishing and, crucially, highlight areas where you may need more training and protection.

Investigate and upgrade your tech protection.

Technology like multifactor authentication (MFA) boosts your ability to screen out scams distributed by bots. Tech tools like behavioral biometrics can also help you and your team spot the difference between fraudsters and genuine users.

Go directly to the source.

Are you in doubt about the authenticity of any company communications you’ve received? Reach out to the company directly to verify the origin of any suspicious emails, voicemails, or texts. For example, if the communication claims to be from Truist, you can ask your relationship manager to confirm it’s legitimate before taking any action.

Update your cyber insurance coverage.

If prevention fails and your company is attacked, a social engineering fraud insurance policy can help minimize your losses. Talk to your agent to learn what’s available and what makes the most sense for your business.

FAQs on social engineering fraud