In more detail
Social engineering is manipulating people, rather than breaking technology, to get them to reveal information or take a harmful action. Attackers exploit trust, urgency, fear and helpfulness: a caller claiming to be IT support, a fake invoice, a "boss" asking for gift cards. Phishing is the best-known form; others are phone calls (vishing), text messages (smishing), pretexting with an invented backstory, baiting with a planted USB stick, and tailgating through a secured door. Defences are verifying requests through a second channel, a culture where it is safe to say "let me check", and processes that do not rely on a single person's judgement.
Why it matters
Most breaches start with a person, not a software flaw, because it is cheaper to ask for a password than to crack one. Technical controls help, and Multi-factor authentication (MFA) limits the damage of a stolen password, but the attacker only needs one person to say yes at the wrong moment.
Example
A message that appears to come from the finance director reads: "I am in a meeting and cannot talk. Please pay the attached invoice today and keep this between us." Warning signs: unusual urgency and secrecy, a changed bank account, and a sender address that looks right but is not, such as examp1e.com with a digit one in place of the letter l. The safe move is to call the director on a known number and follow the normal payment approval process.
Common confusion
Phishing is one technique within social engineering, usually in writing and at scale. Social engineering also covers phone calls and in-person tricks.