Social engineering targets people rather than technical flaws. An attacker might call pretending to be "IT support", email as "the director" or turn up at the office as a "technician".
Phishing is one form of social engineering. The best defence is simple rules everyone knows: always verify financial requests through another channel, and never share passwords or codes with anyone.
Example
The accountant gets a message from "the director": "Transfer the money urgently, I'm in a meeting." A call to the director confirms it's a scam.