What Is Social Engineering · 1.2
🎯 The Psychology Attackers Exploit
Six levers that make manipulation work, every time⏱ ~2 min
Robert Cialdini's research on persuasion identified principles that show up in nearly every social engineering attack. Recognizing them in the moment is the single best defense.
| Principle | How It's Exploited | Example |
|---|---|---|
| Authority | People comply with requests from perceived figures of authority | Email impersonating the CEO demanding an urgent wire transfer |
| Urgency / Scarcity | Pressure to act fast short-circuits careful thinking | 'Your account will be suspended in 24 hours unless you verify now' |
| Social proof | People follow what others appear to be doing | Fake reviews, 'Your colleague already approved this' |
| Liking / Rapport | People say yes to those they like or feel connected to | Attacker builds a friendly rapport over weeks before the ask |
| Reciprocity | People feel obligated to return a favor | Free gift, free software, or a 'helpful' gesture before the request |
| Fear | Fear overrides rational evaluation of a request | 'Your computer is infected — call this number immediately' |
⚠ WarningUrgency and fear are the two most common levers because they actively suppress the part of the brain responsible for careful evaluation. Any message that pressures you to act 'right now' or 'before it's too late' should be treated as a red flag, not a reason to hurry.
Why Smart, Trained People Still Fall For It
★ FactSocial engineering isn't about tricking unintelligent people — it's about exploiting predictable cognitive shortcuts everyone uses to function in daily life. Security researchers, IT staff, and even penetration testers have been successfully social engineered in controlled tests. The goal of training isn't to never feel the pull of these tactics — it's to build a habit of pausing and verifying before acting on them.
🧠Quick Checkfirst try = +5 XP
Why do attackers create urgency ('act NOW!')?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days