Executive Summary
The retail and hospitality sectors operate on high-velocity human interaction, making their front lines a major target for sophisticated social engineering attacks.
Historically, organizations have relied on annual compliance videos and predictable phishing simulations to train frontline workers. While they were initially valuable, this type of traditional training no longer matches how attacks arrive or their increasing diversity and scale. The 2026 Verizon Data Breach Investigations Report reveals that ~62% of security breaches continue to involve the human element.
Countering automated, AI-driven campaigns takes more than traditional security compliance training programs. It takes human risk management (HRM): an approach that reduces human risk by changing how employees recognize and respond to an attack in real time, not once a year.
Key Takeaways
- Primary Threat Vector: Threat actors are shifting away from traditional malware delivery or infrastructure exploitation. They are increasingly engaging frontline employees directly, through conversation.
- Attack Methodology: Threat groups like Scattered Spider use open-source reconnaissance on sites like LinkedIn to map out organization charts. They then deploy AI voice cloning to pose as locked-out employees and talk help desk staff into resetting a password and enrolling multi-factor authentication (MFA) on a device they control.
- Sector-Specific Vulnerabilities: Frontline turnover is high enough that an annual training cycle can miss a seasonal or part-time worker’s entire tenure. A workforce rewarded for being fast and accommodating is exactly the opening a social engineer looks for.
- Cross-Channel Blind Spots: Frontline and floor staff work over SMS, radios, mobile apps, and collaboration tools, not just email. A security program built for the inbox alone cannot see the channels where these attacks actually land.
- Velocity of Compromise: Attackers optimize relentlessly and pivot the moment a channel hardens. Once a lure lands, compromise takes under a minute: Verizon’s 2024 DBIR measured a median of 21 seconds to click a phishing link and another 28 seconds to enter credentials. As email defenses caught up, attackers moved to the phone, where CrowdStrike’s 2025 Global Threat Report tracked a 442% surge in vishing.
Threat Actor Playbook: Conversational Social Engineering
Recent incidents show that modern adversaries do not need complex code or zero-day exploits to get past the perimeter. They target the person instead.
Threat groups like Scattered Spider are using generative AI to run multi-channel, conversational campaigns, following a repeatable loop built to get around technical controls, not break through them:
- Open-source reconnaissance: Attackers scrape professional networks to map the org chart, identifying the IT help desk staff and executives to target or impersonate.
- Vishing: Using AI voice cloning, they place high-pressure calls to the help desk, posing as locked-out employees.
- MFA and password reset abuse: They manufacture urgency to get help desk agents to reset the password and enroll MFA on a device they control, turning a support call into a direct foothold.
Sector-Specific Vulnerabilities and Operational Realities
Defending a consumer-facing brand means managing conditions that line up almost exactly with how attackers operate. Cybercriminals exploit three that are characteristic of retail and hospitality:
1. High workforce turnover
The frontline workforce turns over quickly, with much of it on seasonal and part-time contracts. Static, annual training cycles break down in this environment. By the time a seasonal or part-time employee is scheduled for their security awareness block, their contract may already be nearing its end.
2. Weaponization of customer service empathy
Frontline personnel, guest service agents, and business process outsourcing (BPO) representatives are rewarded for keeping customers happy. Social engineers play directly on that instinct.
By manufacturing a high-stress scenario, an angry high-value customer or a critical business delay, they pressure workers into breaking the verification protocols meant to catch exactly this.
3. Cross-channel blind spots
Unlike traditional corporate staff, floor managers and guest-facing employees rarely work from a desktop. Operations rely heavily on SMS, mobile apps, radios, and collaboration platforms. Standard email-only security controls cannot see these secondary channels, leaving blind spots where these attacks actually land.
Voice has become one of the loudest of those blind spots, with attackers increasingly using AI-cloned voices to call help desks and employees directly.
Transitioning to Human Risk Management
Mitigating these risks means shifting from passive, email-centric testing to human risk management. In practice, that changes a few things:
- Testing beyond the inbox: Resilience assessments extend past email to SMS, voice calls, and collaboration channels, the places frontline work actually happens.
- Threat-informed simulations: Generic templates give way to scenarios built from the campaigns actually targeting your sector, not last year’s lures.
- Point-of-failure coaching: Instead of an annual video, a worker who slips gets immediate feedback on the exact lure that fooled them, while it is still fresh.
Recommendations for Security Leaders
Building a more resilient human layer is a data-driven effort: track behavioral risk, model it, and act on it before it becomes an incident. Three moves matter most:
1. Test the help desk across every channel, and harden it
Put your help desk and contact center through realistic pressure, including AI voice calls paired with a follow-up text or email, and see whether agents hold the identity-verification line. Then close the gap the attack needs: require out-of-band or step-up verification before any password or MFA reset, so no single urgent call can hand over an account.
2. Coach at the moment of failure
For a high-turnover workforce, brief, contextual training beats the annual block. When someone slips on a simulation, immediate feedback, right then, helps them recognize the exact pressure used on them, without pulling them off the floor.
3. Score risk by role, and feed it real intelligence
A flat spreadsheet of risk ratings misses where the exposure actually sits. Combine behavioral signals, role and access, and live intelligence on the campaigns aimed at your sector to find the highest-exposure groups, then put your sharpest coaching and monitoring there first: the finance teams that move money, the help desk agents that hold the keys. This is where seeing the whole campaign matters.
The full social engineering attack chain begins with reconnaissance and impersonation long before a call reaches your help desk, and the work we do at Doppel is built on breaking that chain upstream of the inbox, rather than reacting one message at a time.
