The Identity Theft Resource Center reported that about 61 percent of identity misuse cases it handled last year stemmed from a single scheme: account takeover, fueled by social engineering. The figure is a reminder that the easiest path into a company is still through a person who believes they are helping their CEO.
Add generative AI to the mix and the trick is getting harder to spot.
## What happened
- Roughly 61 percent of identity misuse cases reported to the ITRC stemmed from social engineering.
- The dominant pattern was account takeover, where attackers seize a victim's account.
- Common tactics include pretexting, phishing, baiting, tailgating, and impersonation.
- Generative AI is making text, voice, and email lures more convincing.
## How the tricks actually work
Social engineering is not a single technique; it is a portfolio of them. The most common categories are pretexting (inventing a believable story), phishing (fake messages that look real), baiting (dangling a reward), tailgating (piggybacking on trust to slip into a restricted area), and impersonation (pretending to be someone with authority).
Each one exploits a different human reflex. Pretexting exploits helpfulness. Phishing exploits urgency. Baiting exploits curiosity. Tailgating exploits politeness. Impersonation exploits deference to authority. None of them exploit a software bug, which is exactly why they keep working against patched, hardened systems.
The new twist is AI. Voice cloning, convincing text, and perfect grammar have wiped out many of the telltale signs. A CEO asking for an urgent payment used to be obvious because the grammar was bad. Now it is not.
## Why this matters
Technical controls keep improving. Phishing-resistant authentication, hardware keys, passkeys, mail filtering, and link rewriting all push the cost of an attack up. Yet social engineering remains the dominant pattern in identity misuse cases, not a niche problem.
That gap, between strong technical controls and persistent human vulnerability, is where most account takeovers still happen. Attackers do not need to beat your mail filter if they can convince a finance clerk to wire money on a Friday afternoon.
## What it means for you
Say you are a security lead at a mid-sized company and the CFO forwards you a strange request from "the CEO" asking for an urgent wire transfer. The right move is to verify the request out-of-band—by phone or in person—before any money moves. If your finance team treats any unusual payment instruction as suspect by default, the AI-enhanced scam loses most of its power.
Broader than that, the cheapest controls are usually awareness training that uses realistic, AI-generated lures, paired with payment-process controls like mandatory callbacks for new vendors or above-threshold transfers. Technology helps, but process is what stops the wire.
## Who should care
- CISOs and security awareness leads:** Training has to keep pace with AI-generated lures.
- Finance and accounts payable teams:** Payment fraud via impersonation is the highest-cost social engineering risk.
- IT and identity teams:** Phishing-resistant MFA reduces the blast radius when credentials do leak.
- HR and recruiting:** New starters are prime targets for fake-CEO and fake-vendor scams.
- Physical security teams:** Tailgating still works in offices with badge readers.
## What to watch next
Watch for the next wave of AI-enhanced scams: deepfake video calls, real-time voice cloning on phone support lines, and personalized spear phishing generated from scraped social profiles. Each one removes another historical tell, so detection has to move to behavior and process, not content.
## Bottom line
The attacker does not need to defeat your firewall if they can persuade your finance team to wire money on a calm Tuesday. Address the human element with training and process, not just the endpoints with software.
Key takeaways
- About 61 percent of identity misuse cases the ITRC handled stemmed from social engineering.
- Tactics include pretexting, phishing, baiting, tailgating, and impersonation.
- Generative AI is removing the old tells, like bad grammar and awkward phrasing.
- Out-of-band verification on financial requests is still the single most effective control.
- Pair training with phishing-resistant MFA and process controls, not one or the other.
Frequently asked questions
What is account takeover?
It is when an attacker gains control of a victim's account, often through stolen credentials obtained via social engineering, and uses it for fraud or further intrusion.
Why does social engineering still work?
Because it exploits human reflexes like helpfulness, urgency, curiosity, and deference to authority, not technical vulnerabilities.
Does AI really make phishing more dangerous?
Yes. AI-generated text, voice, and video remove many of the historical tells that used to give phishing away.
What is the single best control against CEO impersonation scams?
Mandatory out-of-band verification, typically a phone call, on any unusual payment or sensitive request.
Can technical controls alone stop social engineering?
No. Technical controls help, but process controls and awareness training that addresses human reflexes are essential to stopping these attacks. **END**
Source: identityiq.com