---
title: "Social engineering attacks: the ones that cost UK financial firms money"
canonical: https://www.grcmana.io/blog/social-engineering-attacks
published: 2023-10-20
updated: 2026-10-22
authors: ["Harry West"]
---

# Social engineering attacks: the ones that cost UK financial firms money

## Key takeaways

Social engineering attacks manipulate people into handing over money, credentials or data. For a UK financial firm the costliest are payment diversion through compromised or spoofed email and executive impersonation, followed by service-desk resets and pretexting for customer data. Call-back verification, dual authorisation and a fast reporting route stop them more reliably than awareness training alone.

- **Phishing prevalence** — The Cyber Security Breaches Survey 2025/2026 found that 60% of UK medium-sized businesses reported phishing attacks in the previous 12 months, and phishing remained the most common attack type overall.
- **Invoice and mandate scams** — UK Finance's Annual Fraud Report 2026 records £41.3 million lost to invoice and mandate scams in 2025, in which criminals redirect a genuine payment, often by intercepting or compromising email.
- **CEO fraud** — CEO fraud had the highest average loss of the eight authorised push payment scam types UK Finance tracked in 2025, at just over £28,000 per confirmed case.
- **Out-of-band verification** — The UK government's business guidance advises verifying any request to change bank details or make an urgent payment by phoning a trusted contact, never by replying to the message.

Social engineering attacks manipulate people, not systems, into handing over money, credentials or data. The costly ones for a UK financial firm are payment diversion by email, executive impersonation (now with faked voice and video) and service-desk calls to reset passwords and MFA. Process controls such as call-back verification stop them more reliably than awareness training alone.

A supplier's email asks your finance team to change its bank details before Friday's payment run, and someone nearly pays. At an FCA-regulated firm or insurer, that near-miss soon becomes a board question for the ops director, finance director or compliance lead. This list ranks the attacks by what they cost, and pairs each with the control that stops it.

The items were chosen against one test: what an attack can cost a regulated firm of 50 to 250 staff. Attacks that move money come first, then attacks that win access or customer data, then the lower-cost ones that still need a control. Consumer scams and insider threats are out of scope.

## Which social engineering attacks cost UK financial firms the most?

Payment diversion and executive impersonation cost the most, because they move money in a single step. Service-desk resets and pretexting come next, because they hand over access or customer data. The Breaches Survey shows how common the entry points are: in the 12 months before the latest survey, phishing hit 60% of medium businesses and impersonation 38%.

Those figures come from the [Cyber Security Breaches Survey 2025/2026](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), commissioned by DSIT and the Home Office and published on 30 April 2026. They cover 296 medium businesses (50 to 249 staff) within a sample of 2,112 businesses. Across all businesses, phishing was reported by 38%.

| Attack | Who it targets | Process control | ISO 27001 control |
| --- | --- | --- | --- |
| 1. Business email compromise and payment diversion | Finance and accounts payable | Call-back on a known number, dual authorisation | A.5.14 Information transfer |
| 2. Executive impersonation and deepfakes | Finance team, executive assistants | No payment on a voice or video instruction alone | A.5.14 Information transfer |
| 3. Vishing and service-desk resets | IT service desk | Identity checks before any password or MFA reset | A.5.17 Authentication information |
| 4. Phishing and spear phishing | Everyone, senior staff most | A fast, blame-free reporting route | A.6.8 Information security event reporting |
| 5. Pretexting for customer data | Customer service, claims, operations | Verify the requester before disclosing anything | A.5.34 Privacy and protection of PII |
| 6. Smishing | Staff on mobile phones | A rule that the firm never asks for codes by text | A.6.3 Awareness, education and training |
| 7. Tailgating | Reception and office staff | Challenge, sign in and escort visitors | A.7.2 Physical entry |

## Which attacks go straight for the firm's money?

Business email compromise and executive impersonation both aim to make a trusted person approve a payment to the wrong account. They need no malware and no technical breach, only a believable message at the right moment. A verification step outside the message itself is what stops them, so both start with the payment process.

### 1. Business email compromise and payment diversion

**What it is.** A criminal intercepts or spoofs email from a supplier, client or colleague and asks for a payment to new bank details. UK Finance records it as an invoice or mandate scam, and notes that it often involves intercepting emails or compromising an email account.

**When it matters.** Whenever bank details change or an urgent payment is requested. The [UK Finance Annual Fraud Report 2026](https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf) records £41.3 million lost to invoice and mandate scams in 2025, across 2,305 cases reported to its member banks. Of that, 68% (£28 million) was lost from business accounts.

**What to do.** Verify every change of bank details by calling a number you already hold, never one in the email: the UK government's [advice on verifying payment requests](https://www.business.gov.uk/support/digital-technology-cyber-security/avoiding-online-scams-fraud/) warns that the sender's address may have been cloned or hacked. Require two people to approve new payees and payments above a set threshold. Write both rules into your [information transfer controls](https://www.grcmana.io/vault/iso-27001/annex-a-5-14-information-transfer), so they apply to email, phone and messaging alike.

### 2. Executive impersonation and deepfakes

**What it is.** A criminal poses as the CEO or another senior figure and asks for an urgent, often confidential, payment. UK Finance describes the classic version: an email from the firm's own compromised system, or spoofed to look like one, sent to the finance team. AI now adds faked voice and video. The [Canadian Centre for Cyber Security](https://www.cyber.gc.ca/en/guidance/social-engineering-itsap00166) lists deepfake impersonation of trusted individuals among the ways AI makes social engineering more effective, and the [NCSC's assessment of AI and the cyber threat](https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat) judges that AI gives attackers a capability uplift in social engineering.

**When it matters.** When a senior name is attached to urgency, secrecy or a new account. UK Finance recorded 197 CEO fraud cases in 2025, with £5.6 million lost. CEO fraud is the rarest of the eight authorised push payment scam types UK Finance tracks, at under one per cent of cases, but it has the highest average loss: just over £28,000 per confirmed case.

**What to do.** Make a voice note, call or video request insufficient on its own to release a payment, whoever it appears to come from. Apply the call-back rule from item 1: confirm through a second, independent channel, such as the number you already hold for that executive. Tell your executives the rule applies to them too.

Seniority is not a verification method.

## Which attacks go for access and customer data?

Vishing, phishing and pretexting rarely move money directly. They win the credentials, the session or the customer records that make a larger loss possible later. For a regulated firm, a customer-data disclosure can also become a reportable incident. The control in each case sits where the request lands: the service desk, the inbox or the phone line.

### 3. Vishing and service-desk resets

**What it is.** A caller poses as a locked-out employee and persuades the IT service desk to reset a password or re-enrol MFA. Once the reset is done, the attacker holds a working account, often with more privilege than a phished one.

**When it matters.** Whenever resets can be requested by phone, and above all for privileged accounts. In its [May 2025 post on incidents affecting UK retailers](https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers), the NCSC asked organisations to review how their helpdesk authenticates staff before resetting passwords, especially for accounts with escalated privileges.

**What to do.** Set an identity check for every reset that a caller cannot pass from public information, such as a call-back to the number on the HR record or approval from the line manager. Add a stricter route for admin accounts. Record each reset as evidence of your authentication information control (A.5.17).

### 4. Phishing and spear phishing

**What it is.** Scam emails or texts that lead to malicious websites, as the [NCSC's phishing guidance](https://www.ncsc.gov.uk/guidance/phishing) defines it. Spear phishing uses research on your staff or firm to make the message credible. Phishing is also the usual first step of items 1 to 3.

**When it matters.** Always, and most for senior and finance staff. The NCSC notes that spear phishing attacks are even harder to detect than ordinary phishing.

**What to do.** Follow the NCSC's layered approach: make it harder for attackers to reach users, help users spot and report, limit the damage of a successful phish, and respond quickly. The NCSC also warns that no training package can teach users to spot every phishing attempt. The reporting route matters more than the catch rate.

A control that depends on every employee spotting every fake is a hope, not a control.

### 5. Pretexting for customer data

**What it is.** A caller or emailer builds a believable story, such as a customer, a broker or a regulator, to obtain personal or policy data.

**When it matters.** In customer service, claims and operations teams that handle personal data by phone and email every day. A disclosure here can become a personal data breach, not just a fraud attempt.

**What to do.** Give customer-facing teams a verification script, and send sensitive data only to contact details already on file. Treat requests that bypass the script, however plausible, as events to report. Tie the procedure to your privacy and PII controls (A.5.34).

## Which lower-cost attacks still need a control?

Smishing and tailgating rarely produce the largest losses in a financial firm, but both are cheap to attempt and cheap to stop. A short rule for each, written down and known by staff, closes the gap. They belong on the list because a board will still expect to see them covered.

### 6. Smishing

**What it is.** Phishing sent by SMS or text message. The text often claims to come from the firm's IT team, a bank or a delivery service, and asks for a code or a click.

**When it matters.** When staff approve MFA prompts or receive work messages on mobile phones.

**What to do.** Publish one rule: the firm never asks for passwords, MFA codes or payment approvals by text. Make sure the reporting route covers mobile messages, and include smishing examples in [awareness training](https://www.grcmana.io/vault/iso-27001/annex-a-6-3-information-security-awareness-education-and-training).

### 7. Tailgating

**What it is.** Someone follows a member of staff through a secure door without using their own access, usually by looking busy, burdened or familiar.

**When it matters.** In shared office buildings and anywhere that holds paper files, servers or unlocked devices.

**What to do.** Make challenging, signing in and escorting visitors normal behaviour, and cover it under your physical entry control (A.7.2).

## How to use this list

Work from the top. Fix verification procedures and dual authorisation first, because they stop the attacks that move money even when a member of staff has been fooled. A call-back rule costs almost nothing to introduce and can be tested this week.

Next, set up the reporting route. Staff should know exactly how to report a suspicious email, call or text, and reports should reach someone who acts on them. Our guide to [information security event reporting](https://www.grcmana.io/vault/iso-27001/annex-a-6-8-information-security-event-reporting) covers how to make that route work.

Then run awareness training that is realistic for your firm: the supplier email, the urgent call from the CEO, the locked-out colleague. Training supports the process controls. It does not replace them.

We recommend giving each of the seven items an owner and a test date. A board asking about fraud resilience wants evidence that the controls ran, not a training completion rate.

## Frequently asked questions

### What is the difference between phishing and social engineering?

Social engineering is the wider category: any attack that manipulates a person into giving up money, access or data. Phishing is one form of it, delivered by email or text. Vishing, pretexting, executive impersonation and tailgating are other forms that use the phone, a story or physical access instead.

### What are the main types of social engineering attacks?

For a UK financial firm, the main types are business email compromise and payment diversion, executive impersonation, vishing aimed at the service desk, phishing and spear phishing, pretexting, smishing and tailgating. The first two cost the most because they move money directly.

### Can awareness training stop social engineering attacks?

Not on its own. The NCSC points out that asking staff to examine every email in depth would leave them no time for their work, so training lowers the hit rate rather than removing it. Call-back verification, dual authorisation and a fast reporting route are what still hold when a convincing message gets through.

### What should a firm do if a payment has already gone to a fraudster?

Contact your bank straight away so it can try to recover the funds. Then follow your incident response process, which [Annex A 5.26](https://www.grcmana.io/vault/iso-27001/annex-a-5-26-response-to-information-security-incidents) covers. If you do not have one written down, start from an [incident response plan template](https://www.grcmana.io/vault/templates/incident-response-plan).