When I read Kevin Mitnick's Ghost in the Wires, what impressed me was how he'd combine social engineering with technical hacks. For example even if people did call their boss or Kevin's alleged employer (the utility company, a partner company, whatever), he would have set up their phone system to send the call to himself. I'm sure that social engineering alone gets you a long way, and I'm sure that Kevin was good at it, but when your electronic communications aren't trustworthy you can really do a number on people! How are you even supposed to defend against that?