Social engineering remains the most consistent entry point for successful cyberattacks in 2026. Verizon’s 2024 DBIR shows it is involved in the majority of breaches. Pretexting and AI voice cloning are accelerating impersonation scams, while 42% of workers admit to clicking a suspicious link or email. Learn how to spot AI voice cloning scams before a phone call becomes a theft, and report incidents to the FTC.
The high worker click rate matters because one mistaken click can bypass technical controls. Attackers use AI to craft context-aware phishing messages and then scale them across thousands of inboxes. The fastest-growing pretexting tactic works the same way: a scammer pretends to be a trusted person or institution. Review AI phishing email identification techniques to reduce that 42% click rate.
AI voice cloning changes the risk for older adults and anyone who answers unknown calls. A short audio sample from social media can be enough to create a convincing fake voice. That makes family emergency and government impersonation scams harder to reject on tone alone. Families can use steps to protect elderly parents from AI scams and verify unexpected requests through a separate channel. File complaints through FBI IC3 when money is lost.
Headline Social Engineering Statistics 2026
| Stat | Detail | Source |
|---|---|---|
| Majority of successful cyberattacks | Social engineering is involved in the majority of successful cyberattacks, making human manipulation the most consistent breach vector. | Verizon DBIR, 2024 |
| One of the fastest-growing tactics | Pretexting, or impersonation, ranks among the fastest-growing social engineering tactics observed in incidents. | Verizon DBIR, 2024 |
| AI voice cloning amplifies scams | AI voice cloning makes impersonation scams more convincing at scale, lowering the effort needed to mimic trusted voices. | FTC, 2024 |
| Older adults disproportionately targeted | Older adults are disproportionately targeted by impersonation scams, including family emergency and government fraud schemes. | FTC, 2024 |
| 42% of workers clicked suspicious content | 42% of workers admit to clicking a suspicious link or email, fueling credential theft and malware delivery. | Tessian, 2024 |
AI Impersonation and Voice Cloning Risk
| Stat | Detail | Source |
|---|---|---|
| AI voice cloning makes impersonation easier | Cloned voices let scammers pose as family members, executives, or officials in real time with high believability. | FTC, 2024 |
| Pretexting is growing | Impersonation-based pretexting is one of the fastest-growing social engineering tactics in breach data. | Verizon DBIR, 2024 |
| Older adults face elevated risk | Older adults are disproportionately targeted by impersonation scams, often through phone calls and urgent requests. | FTC, 2024 |
Human Error and Phishing Click Rates
| Stat | Detail | Source |
|---|---|---|
| 42% of workers click suspicious links | 42% of workers admit to clicking a suspicious link or email, highlighting the human error behind many attacks. | Tessian, 2024 |
| Majority of breaches involve social engineering | Social engineering is involved in the majority of successful cyberattacks, not just technical exploits. | Verizon DBIR, 2024 |
Frequently Asked Questions
What is social engineering?
Social engineering is psychological manipulation that tricks people into giving up access, money, or information. Attackers often pose as trusted companies, coworkers, or family members. The goal is to bypass technical security by exploiting human trust. See how to verify AI vs human for detection steps.
Why is AI voice cloning making social engineering more dangerous?
AI voice cloning lets scammers copy a person’s voice from a short recording and use it to impersonate that person in real time. This makes family emergency scams and business email compromise more convincing. The FTC has warned that cloned voices reduce the effort needed to run impersonation scams at scale.
Are older adults more at risk from impersonation scams?
Yes. FTC data show older adults are disproportionately targeted by impersonation scams. Scammers often pose as government agencies, tech support, or grandchildren in distress. Use family protection steps for elderly relatives to set up verification routines.
What should I do if I clicked a suspicious link or email?
Disconnect the device from the network and change credentials from a clean device. Watch for unauthorized logins and consider freezing credit if personal data was exposed. Use the AI phishing email guide to spot future attempts.
How can I report a social engineering scam?
Report scams to the FTC and, if money was lost, file a complaint with the FBI IC3. You can also file with the BBB Scam Tracker. Detailed reports help law enforcement track AI-driven impersonation patterns. See how to report an AI scam step by step.
Does freezing my credit help after an impersonation scam?
A credit freeze can block new accounts if scammers have your Social Security number or other identity details. It is a useful containment step after a data exposure. Learn how to freeze credit after AI identity theft.
