The trouble is that normal operations are often indistinguishable from social engineering.

I have worked several places where I have been told by management that something needs fixed on a web server, but they can't remember any passwords, so could I call up their ISP and just get it sorted.

In these situations, I have never had to prove anything I couldn't have faked and I usually get asked to provide an email address so they can send me the details.

As this kind of behaviour seems very common, most everything seems to be wide open for social engineering. So given that everything isn't hacked all of the time, people in general must be both much nicer and much lazier than I had otherwise assumed.