Reverse Social Engineering

Reverse social engineering inverts the usual direction of a social engineering attack. Instead of approaching the victim, the attacker engineers a situation in which the victim reaches out to them — for help, support, or information. Because the victim initiated the contact, the normal skepticism toward unsolicited callers never activates: people rarely question the legitimacy of someone they chose to call.

How it works

The classic model has three stages. First, sabotage or pretext: the attacker creates a problem, or the appearance of one — a disconnected service, a planted error message, a warning email that a mailbox is about to be suspended. Second, advertising: the attacker positions themselves as the solution, by planting a "support" phone number in the error message, posing beforehand as the new IT contact, or listing a fraudulent helpline where victims will search for one. Third, assisting: the victim calls, the attacker helpfully "fixes" the problem — and in the process harvests credentials, has the victim install remote-access software, or extracts sensitive information.

Modern variants are everywhere once you know the shape: fake invoice emails whose real payload is the billing-dispute phone number (callback phishing), search ads for fraudulent airline or bank support lines, and browser pop-ups telling the victim to call "Microsoft." The same self-initiated-trust dynamic powers tech support scams at consumer scale, and in the enterprise it mirrors the trust confusion exploited in help desk impersonation attacks.

How to defend against it

• Publish one canonical support channel and train employees that IT will never be reached through numbers embedded in error messages, emails, or search ads.
• Treat inbound "I was told to call you" requests with the same verification as outbound ones — the direction of contact proves nothing about identity.
• Simulate it. Include planted-number and callback lures in awareness exercises, not just classic phishing links.
• Make verification cheap. A searchable internal directory and a norm of hanging up and calling back through a known number removes the attacker's main advantage.