E-mails are often used by attackers to obtain confidential information or to trick users into other harmful behaviour. For example, an attacker may send an e-mail purporting to be from a manager that instructs the recipient to carry out actions that will harm the corresponding organisation (known as CEO fraud). This often involves instructions to transfer money to accounts abroad.

A fake e-mail from a real and trustworthy provider may also request that access data be entered on a website (phishing). The access data thus obtained can then be used by the attacker to take further action.

The danger of social engineering increases if users are not regularly trained and made aware of these threats.