The most effective defense against social engineering is awareness; users should never share their ID or grant access to unsolicited "technicians."