In a ______ scam, thieves gain personal information about a victim by pretending to be a legitimate business?

• A. Phishing
• B. Vishing
• C. Tailgating
• D. Social engineering

Answer: (D)

Social engineering is the practice of manipulating people into revealing confidential information by posing as a trusted or legitimate entity. In this scenario, the attacker pretends to be a legitimate business to trick the victim into sharing personal data, which is exactly how social engineering operates. It’s a broad tactic that includes various methods (not just one channel), such as impersonation via phone, email, or in person.

Phishing is a specific form of social engineering that uses electronic messages to lure information, so it’s a subset of social engineering rather than the broader concept. Vishing is phishing over the phone, also a specific method. Tailgating is a physical security tactic to enter a restricted area, not about acquiring personal information through deception. To defend against social engineering, verify identities through official channels, avoid sharing sensitive data unless you initiated the contact, and train people to recognize pretexts and impersonation attempts.