Social Engineering Is Rewriting the Fraud Playbook

In February 2024, an employee at British multinational design and engineering company Arup’s Hong Kong office logged into a video call with the firm’s UK-based CFO and a handful of familiar colleagues. The topic was a confidential transaction. He hesitated at first; something about it didn’t quite sit right. But everyone onscreen looked and sounded exactly like the people he worked with every day, so he went ahead. Over the next several days, he wired fifteen separate transfers to five local bank accounts. The total came to roughly $25.6 million.

Not one person on that call was real.

This case has become a cautionary tale and for good reason. It captures how far the ground has shifted. Fraud used to be a problem you solved with better systems. Increasingly, it’s a problem you solve with better-trained people.

The Shift: Why Social Engineering Now Dominates

For years, “social engineering” meant a poorly spelled email asking someone to verify their password. That’s not what institutions are up against anymore. Business email compromise attacks today often contain no malware and no malicious link at all, which means the email security tools institutions have invested millions in simply have nothing to flag. The attacker isn’t hacking a system, they’re impersonating a senior executive, and they’ve done their homework (e.g. the org chart, travel schedule, even identifying who’s new on the team and therefore less likely to question an unusual request).

Meanwhile, the person behind an “urgent” email has one objective: get the target to act before they think. Authority (“this is the CEO”), urgency (“the deal closes today”), and secrecy (“don’t mention this to anyone”) are deployed deliberately to short-circuit careful consideration that would typically be warranted with such a request.

Layer generative AI on top of that. Cloned voices, real-time deepfake video, chatbots that can hold a convincing conversation. The result is a class of attack that would have sounded like science fiction a decade ago. Deloitte estimates generative AI could push fraud losses in the US alone to $40 billion by 2027. That figure should be read as a floor, not a ceiling.

What Effective Training Looks Like

In case after case, the difference between a near-miss and a multi-million-dollar loss comes down to one variable: whether someone paused to verify. Not whether they were senior enough, technical enough, or naturally skeptical. Whether they paused. That is what effective training should be designed to produce: an automatic instinct to verify before acting, especially where money or sensitive data is involved.

While it’s best practice to ensure all employee training is updated regularly, it’s even more crucial for programs on the topic of fraud to ensure your staff are aware of the latest threats. To move beyond awareness, fraud training should be complemented by phishing tests, mock vishing calls, and scenarios tailored to the specific pressures different teams face. This needs to be underpinned by a no-blame reporting culture. The moment employees fear punishment for raising a false alarm, they stop raising alarms altogether, including the real ones.

People and Systems Working Together

These elements don’t replace technical controls, they complement them. Institutions that hold up best against emerging threats treat human judgment and automated detection as a single integrated system. And they continue investing in their human layer of defense year after year through training that incorporates real scenarios, regular practice, and a culture where people feel comfortable raising a hand when something looks off.