How attackers manipulate people
The psychological levers behind phishing, phone calls and visitors at the door, and the one habit that defeats them all.
Attackers exploit feelings rather than security gaps: curiosity, fear, time pressure, authority, helpfulness, trust. The most dangerous state is autopilot, when you click on the side and out of habit. The counter-rule: a strong feeling is the warning sign. Pause first, then act.
Chapter A · Why it comes down to you
Attacks on people are called social engineering: someone gets you to do something you would never do with a clear head. It works by email, on the phone, in chat and at the office door too, because the levers are always the same.
The levers
- Time pressure: "by 12 noon", "otherwise the account will be blocked". Stress blocks critical thinking.
- Authority: the message seems to come from management, the bank, the police or IT. Who contradicts the boss?
- Fear and threats: reminders, penalties, data loss, legal warnings.
- Curiosity: "Salary list 2026", "Photos from the Christmas party", an unexpected parcel notification.
- Helpfulness: a friendly "technician" briefly needs your login, a colleague from the branch "has forgotten her password".
- Trust: the message mentions real names, real projects, refers to a real conversation.
- Greed and anticipation: a prize, a refund, a voucher.
The most dangerous state: autopilot
There is a big difference between expecting a suspicious email in a training session and working through fifty emails between two phone calls on a Monday morning. Attackers rely on exactly this automatism: they prefer to send just before the end of the working day, on Friday afternoons or before public holidays, when everyone wants to finish quickly.
If a message, a call or a person at the door triggers a strong feeling in you, such as urgency, fear, curiosity or the wish to help, then that is exactly the warning sign. Pause before you act.
You don't see the preparation
Good attacks are prepared. From the legal notice, career profiles and job ads, attackers know who approves invoices, which software you use and who is on holiday right now. With AI tools, these building blocks become a convincing, error-free message in minutes. We come back to this in Chapter E.
One question almost always helps: Does this request deviate from the usual way? A transfer without an order, a password over the phone, a visitor who was not announced. Deviation plus pressure is the pattern of almost every attack.
What is the most reliable way to recognise a social engineering attempt?
More than one answer may be correct.
Language errors are no longer a reliable sign, and real names are easy to research. What remains is the pattern: pressure, feeling and a deviation from the usual way.