Lesson 2 of 14

How attackers manipulate people

The psychological levers behind phishing, phone calls and visitors at the door, and the one habit that defeats them all.

Chapter A · Why it comes down to you

Attacks on people are called social engineering: someone gets you to do something you would never do with a clear head. It works by email, on the phone, in chat and at the office door too, because the levers are always the same.

How attackers manipulate people

The levers

Time pressure: "by 12 noon", "otherwise the account will be blocked". Stress blocks critical thinking.
Authority: the message seems to come from management, the bank, the police or IT. Who contradicts the boss?
Fear and threats: reminders, penalties, data loss, legal warnings.
Curiosity: "Salary list 2026", "Photos from the Christmas party", an unexpected parcel notification.
Helpfulness: a friendly "technician" briefly needs your login, a colleague from the branch "has forgotten her password".

How attackers manipulate people

The levers (continued)

Trust: the message mentions real names, real projects, refers to a real conversation.
Greed and anticipation: a prize, a refund, a voucher.

How attackers manipulate people

The most dangerous state: autopilot

There is a big difference between expecting a suspicious email in a training session and working through fifty emails between two phone calls on a Monday morning. Attackers rely on exactly this automatism: they prefer to send just before the end of the working day, on Friday afternoons or before public holidays, when everyone wants to finish quickly.

The most dangerous state: autopilot

★ Remember

If a message, a call or a person at the door triggers a strong feeling in you, such as urgency, fear, curiosity or the wish to help, then that is exactly the warning sign. Pause before you act.

How attackers manipulate people

You don't see the preparation

Good attacks are prepared. From the legal notice, career profiles and job ads, attackers know who approves invoices, which software you use and who is on holiday right now. With AI tools, these building blocks become a convincing, error-free message in minutes. We come back to this in Chapter E.

You don't see the preparation

💡 Practical tip

One question almost always helps: Does this request deviate from the usual way? A transfer without an order, a password over the phone, a visitor who was not announced. Deviation plus pressure is the pattern of almost every attack.

Quiz question · Join in

What is the most reliable way to recognise a social engineering attempt?

By pressure and strong feelings such as urgency, fear or curiosity
By the fact that a usual procedure is supposed to be bypassed
By spelling mistakes; without them a message is genuine
By the fact that attackers never know real names

No answers yet.

Scan and join in

0 answers

Try it with your phone. All visitors share this demo; it starts empty again every night.

Sample · lesson 2 of 14

That was the sample.

The full course “Security at Work in the Office” has 14 lessons like this.

Open lesson for reading Go to the course