A social engineering lure is a deceptive prompt, page, or message designed to push a user into taking an action that helps the attacker. Unlike a technical exploit, it relies on trust, urgency, or habit. A fake CAPTCHA, login warning, or “verify your browser” screen can be a lure if it convinces the victim to click, enter credentials, run a command, or download a file.
This matters in cyber security because user action can open the door even when the server, browser, or endpoint is not directly broken. In real attacks, a compromised website may display a convincing verification step that routes visitors to malware or credential theft. Defenders look for mismatched domains, unexpected prompts, unusual script behavior, and suspicious download or execution chains. User awareness, web filtering, browser monitoring, and endpoint telemetry all help reduce the impact of these lures.