Incident Response for Social-Engineering Attacks

When attackers used a deepfaked video call to talk an Arup finance employee into 15 transfers totaling $25.6 million, no malware touched a single endpoint. There was nothing to quarantine, no CVE to patch, no ransomware note to negotiate over. And that is precisely the problem: most incident response plans are malware-shaped, while most breaches are not. The Verizon DBIR attributes 62% of breaches to the human element, and IBM's Cost of a Data Breach report puts the average at $4.99 million with 247 days to identify and contain — long enough for an attacker with valid credentials to become indistinguishable from an employee.

This guide is the missing chapter of the IR binder: what to actually do in the first hours after someone is successfully phished, vished, or manipulated — and how to build the muscle before it happens.

Why the standard playbook misses

A classic incident response process assumes an artifact: a binary to detonate in a sandbox, an exploited service to isolate, an IOC list to sweep for. A social-engineering breach hands you none of that. What the attacker holds after a successful account takeover is a set of perfectly legitimate things:

• Credentials that pass every authentication check
• Session tokens stolen through adversary-in-the-middle pages, which survive a password reset (see session hijacking)
• OAuth grants from consent phishing, which survive both a password reset and a session revocation
• An enrolled MFA device the attacker added during the intrusion, giving them a durable second factor
• A business process — a payment approval, a vendor bank-detail change, a help-desk reset — bent to their benefit
• Trust, which no console can revoke

NIST's rewritten incident response guidance, SP 800-61r3 (April 2025), retired the idea of IR as a standalone technical cycle and folded it into continuous risk management across the CSF 2.0 functions. That framing fits social engineering well: the response is less "clean the machine" and more "unwind every artifact of trust the attacker acquired, then fix the process that let them acquire it."

A social-engineering breach is not a malware incident with a human patient zero. It is an identity and money incident — and the containment console is your IdP, your mail platform, and your bank's fraud desk.

The first hour, by attack type

Containment moves differ sharply by how the attacker got in. The table below is the one-page version to put in the runbook.

Attack	What the attacker actually holds	First containment moves
Credential phishing (AiTM proxy)	Password and live session cookie	Revoke all sessions/refresh tokens, then reset the password — in that order; check for new inbox rules
BEC / wire fraud	A payment in flight, often mailbox persistence	Call the bank's fraud line for a recall, file with IC3, then hunt forwarding rules and thread hijacks
MFA fatigue push bombing	An approved push + often a newly enrolled device	Revoke sessions, remove MFA methods enrolled since the event, re-verify enrollment out-of-band
Deepfake voice / vendor change	An approved process change (bank details, urgent transfer)	Freeze the payment run, verify via known-good callback, alert the real vendor and the bank
Help-desk impersonation	A reset credential or re-registered MFA	Reverse the reset, audit every account the help desk touched that day, review reset procedure

Two patterns run through every row. First, sessions before passwords: resetting a password while attacker sessions stay alive is the most common containment mistake in modern identity attacks — CISA's Scattered Spider advisory documents exactly this tradecraft, from push bombing to help-desk resets. Second, the money moves faster than the forensics: financial containment cannot wait for the investigation to finish.

The money clock

If funds moved, you are racing settlement, not the attacker. The FBI's IC3 2025 annual report counted $20.9 billion in reported losses, with business email compromise alone at roughly $3 billion — and the great majority of BEC losses leave via wire transfer or ACH. The countermeasure is the Financial Fraud Kill Chain: report the fraudulent transfer to your bank and to IC3 immediately, and the FBI's Recovery Asset Team works with the receiving institutions to freeze funds before they scatter through mule accounts. It freezes hundreds of millions of dollars a year — but effectiveness decays by the hour, which is why the bank call belongs in the first sixty minutes of the runbook, next to "revoke sessions," not in the post-incident report.

One more thing belongs on the money clock: evidence. Export the original emails with full headers, capture the phishing page URL before it is taken down, save call logs and message threads, and note every timestamp as you act. The same records that support a recall request and an insurance claim also feed the regulatory timeline you may need to produce later — and they are much harder to reconstruct a week after the fact.

A six-step response playbook

1. Make reporting instant, blameless, and rewarded. Nothing else on this list works if the incident stays hidden. The employee who clicked, approved, or paid is your only sensor — and shame is the attacker's best persistence mechanism. Publish a one-line rule ("If something feels off, report it — you will never be punished for reporting"), give it a one-click channel, and treat time-to-report as a first-class metric in your human risk score.

2. Scope the identity blast radius. Before touching anything, enumerate what the compromised person could reach: active sessions, refresh tokens, OAuth grants, recently enrolled MFA devices, mailbox rules, delegated access, and any privileged roles. In an AiTM or consent-phishing case, assume the token — not the password — is the crown jewel.

3. Contain in the right order. Revoke sessions and refresh tokens first, reset credentials second, strip unrecognized MFA enrollments third, then remove malicious inbox rules and OAuth grants. Re-enroll MFA through a verified out-of-band process, not the same help-desk path the attacker may have just exploited.

4. Chase the money in parallel. A second responder — not the one doing identity containment — calls the bank's fraud team, requests a recall/freeze, and files the IC3 complaint with full wire details. Alert the counterparty whose identity was abused (the spoofed vendor, the impersonated executive) so they can warn other targets.

5. Notify on the legal clock. If personal data was touched, GDPR Article 33's 72-hour window starts at awareness — and awareness started at step 1. Loop in counsel early, document the timeline as you go, and remember that a well-documented fast response is itself mitigation in regulators' eyes.

6. Convert the incident into prevention. Feed what happened back into the program: retrain the individuals involved with the actual lure as the teaching material, run a targeted phishing simulation on the same pattern across the org 30 days later, and pressure-test the fixed process in your next tabletop exercise. An incident whose lessons reach only the SOC is a lesson the attackers will teach again.

Measure the response, not just the incident

Post-incident reviews usually ask what happened; the more useful question is how fast did the system react. Four numbers tell you whether the next incident will go better: time from lure to first report, time from report to session revocation, time from fraud discovery to bank contact, and the share of affected accounts where attacker persistence (rogue MFA devices, inbox rules, OAuth grants) was found and removed on the first pass. Trend them across incidents and simulations alike — a human risk program that only measures click rates is watching the entry wound and ignoring the response reflex.

Rehearse before it happens

The difference between a $500 incident and a $25 million one is rarely the sophistication of the attack — it is whether the first responder knew the order of operations. Write the one-page runbook, put the bank fraud line and IC3 in it, rehearse the identity revocation sequence until it is muscle memory, and measure how fast your people raise their hand. When the call comes, you will be glad the plan was shaped like the breach.