What is reverse social engineering? Is it something different from normal social engineering?

3 Answers 3


Reverse social engineering (RSE) can mean two things - attack where attacker is trustworthy entity (case 1) or attack where attacker becomes victim (case 2).

When we talk about case 1 there are usually three stages of attack. Stage one is called sabotage where initial damage is made. Stage two or advertise is where attacker gains trust of victim and pursue him/her he is the one who can solve problem they have (made in stage 1). Stage three (assist) is where the attacker gains information/property he needs.

Advantage of RSE is that attack is much harder to discover. On the other hand, main disadvantage is complexity.

The best defense against this type of SE (social engineering) is to use trustworthy companies to do whatever job you need to outsource. Also, background checking on persons who has access to your critical areas can prevent such attacks.

Case 2 is situation where initial attacker becomes victim. However, this types of SE is highly unlikely to happen in business environment and it's mostly found in military (or to use fancy word - counterintelligence).

Example of this kind attack could be so called "Reverse sting" where when attack is recognized victim can preform attack on initial attacker or he can redirect attacker to someone who knows how to counter him. E.g. attackers calls front desk and asks for information X. Instead of giving him information X, front desk redirects call to security department. Other example of case 2 RSE is where attacker is fed with false data (law enforcement agencies often preform this attack).


Reverse social engineering is a form of social engineering. We can say all reverse social engineering attacks are a social engineering attack.

A reverse social engineering attack is where an attacker makes himself a point of help to a victim. The victim will think of the attacker as a trustworthy person because he is offering help to solve the problem.

An example can be an attacker first sabotaging a network and then posing as a technician to help and resolve the problem for the victim.

This approach is often used because the victim will give up passwords more easily. If you get called by someone and they ask you your password, you will be reluctant to give it. If you call a technician and he requests your password, you are more likely to give it.

Further reading: reverse social engineering in online social networks.

  • 4
    The paper defines it as "In a reverse social engineering attack, the attacker does not initiate contact with the victim. Rather, the victim is tricked into contacting the attacker herself." If this is correct it sums it up nicely. Aug 16, 2012 at 0:27

Reverse social engineering does not differ from 'normal' social engineering in a significant way, beyond the fact that the stance taken could be described as being somewhat "passive".

The reversal lies in the pretext used, and aims to entice a victim to take action on one's own initiative, hence amplifying perceived trust.

An example would be posing as an authority figure to establish initial contact and triggering certain followup actions, as opposed to an attacker approaching victims himself to do the same.

Watering hole attacks are an example of reverse social engineering:

Sinkholing Script Kiddies

  • As stated in a previous answer, the attacker is not necessarily passive (ie. sabotage...), but a keyword in your answer is indeed the term "initiative", since the the victim will contact the attacker on its own initiative, giving him far more trust from the start than in classic social engineering attack. May 2, 2015 at 21:26
  • Regardless of preceding events such as (active) sabotage, there would arguably be a passive element that follows. May 3, 2015 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .