How to Make Your Brain Say “Yes” When It Wants to Scream “No”
So — did we survive the first two? Time to take a moment and reflect on what has transpired. In Part One, we were “digital stalkers.” We explored the digital footprints of an individual via their garbage and their Instagram posts. We made ourselves nearly invisible. In Part Two, we transitioned from the shadows to the sunlight. We discovered ways to engage strangers, adopt a “helpless relative” persona, and obtain individuals’ passwords simply by having them want to assist us.
All of these have served as a prelude or warm-up for our “real” battle.
We are now entering the realm of influence and manipulation that Christopher Hadnagy refers to as the “Holy Grail” of social engineering. This is where the art of influencing and manipulating another’s thoughts and behaviors truly begins.
Do you remember that queasy feeling you got walking out of an electronics store with a pricey coffee maker (even though you originally went in for batteries)? Or, do you recall signing a petition while running late for a meeting? You never really understood how that occurred. It felt like you were in some sort of haze.
Congratulations. You’ve just been socially engineered. And, no computer was involved. That person simply pushed the right button(s) within your brain.
This last and largest segment will be about deconstructing that social engineer. We’ll open up the hood of your mind, and explore specifically which levers the social engineers use to transform a capable and reasonable adult into a puppet.
1. The Free Cheese Trap (The Principle of Reciprocity)
Let’s start with a classic. This principle is as old as time itself, hardwired into our DNA. Robert Cialdini — the godfather of influence psychology — calls it the Rule of Reciprocity.
The idea is painfully simple: when someone gives us something, we feel a physical need to give something back. We don’t want to be in debt. Debt weighs on us like a stone.
Here’s what it looks like in real life: remember the Hare Krishnas in airports back in the ’90s? They didn’t ask for money right away. They’d rush up and push a flower into your hands. Or a little book.
“It’s a gift! Take it — from the heart!”
You’d take the flower (you can’t just throw it on the floor — that would be rude). You’d walk a couple of meters, and then the Krishna devotee would gently say:
“We’re collecting donations for the temple — could you spare a few dollars?”
And people paid. The numbers were crazy. Why? Because that damn flower burned in your hands. Your brain was screaming: “You took a gift. You owe them. Pay the debt.”
Now, how does a hacker use this?
Hadnagy describes a brilliant attack on a system administrator. The attacker needed to learn the structure of a database. A direct approach wouldn’t work. So what did they do? They found out (through social media, of course) that the admin was a fan of a particular online game.
The hacker spent a couple of days leveling up, earned a rare in-game shield, found the admin on a forum, started chatting — and then simply gave them the shield. For free.
“Here, man. I don’t need it — it’ll suit you.”
The admin was thrilled. He was overflowing with gratitude. “Dude, you’re awesome! How can I repay you?”
The hacker waited a week. Then he wrote:
“Listen, I’m swamped at work. My boss wants a report on an SQL database, and I’m blanking. Could you take a quick look at my code? I think I messed up the structure.”
Guess what happened?
The admin didn’t just “take a look.” He fixed the code. He explained in detail how it should be done — using examples from his actual work database. He leaked sensitive information because he felt guilty about that gifted virtual shield.
Lesson: Beware of Greeks bearing gifts. If a stranger does you a favor you never asked for, it’s not kindness. It’s a hook.
2. The “Foot-in-the-Door” Effect (Commitment and Consistency)
People are often consistent in their behavior. Once they’ve stated that “A”, then it’s difficult for them to do otherwise than “B”. When we say we’re “patriots,” we’ll likely purchase the small flag; when we say we’re “professional” employees, we’ll probably help a co-worker. Social engineers exploit our natural desire for consistency to lead us down a path of performing horrible actions — beginning with a small, innocuous action.
The Heavy Box Story
This is one of my favorite examples from the book — brilliant in its simplicity. A social engineer needs to get into an office. The doors are secured with magnetic locks, access cards only. Security is alert. He doesn’t try to break the lock.
He buys a huge cardboard box. Fills it with old books so it’s genuinely heavy. He approaches the door at the exact moment an employee is walking out. The hacker pretends he can barely carry the load. Sweat pouring, hands shaking, the box about to slip. He looks at the employee with pleading eyes. He says nothing.
What does the employee do? He holds the door.
“Thanks, buddy — really saved me,” the hacker says as he walks inside.
Why did it work? Because the employee sees himself as a good person. In his head, there’s a core belief: “I’m polite. I help people.” Letting a door slam in the face of someone carrying a heavy load would make him the bad guy — and that would shatter his self-image.
The hacker got him to violate security policy simply by exploiting his need to be decent.
The uncomfortable truth: the easiest people to hack are kind, empathetic ones. Cynics and misanthropes survive more often.
3. The “God Syndrome” (Authority)
From birth on we are trained to follow the rules. Our parents, teachers, doctors and police officers all enforce the rules. When someone dresses like a boss, it instantly shuts down our critical thinking processes.
Hadnagy describes how people use their attire and tone of voice to create the illusion that the rules don’t apply to them. Put on a t-shirt, go to a receptionist’s desk and ask her for a complete list of employee phone numbers – she will call security to remove you. However, if you wear a business suit, carry a leather binder, check your watch and speak with authority in a slighty annoyed voice:
“Hi, I am an auditor from corporate. I have a meeting with the CEO in ten minutes. And I cannot locate the internal contact number for Ms. Olena from Accounting. Can you please hurry this along? I do not have time to play around.”
All of a sudden, things start to break your way.
She’ll apologize, hand you the list, maybe even ask if she can get you some coffee. Why? Because you’re portraying yourself as an authority figure. When people are afraid of punishment – or being fired, their rationality ceases to function. She’s not going to think “Is he really who he says he is?” – she’ll be thinking “If I hold him up and he really is from the CEO’s office, I’m gone.”
The Milgram Experiment. The author also reminds us of the chilling results of Stanley Milgram’s experiment. Regular folks were willing to give what they thought were lethal electrical shock to other actors (the subjects) simply based on a guy in a white lab coat telling them calmly, “Continue please. This is required by the study.”
We tend to rely on uniforms, job titles and confident voices when it comes to trusting our instincts about whether someone is trustworthy. And hackers are aware of this tendency.
4. Artificial Scarcity: “Today Only — Just for You!”
Not just used by social engineers, this technique is also employed by marketers; when we think that there’s limited availability (or ‘limited supply’) of a product or service, the survival instincts of our primitive brain kick in.
“Last Chance!”
“The sale ends in 15 minutes.”
“There are only two tickets available.”
Artificial scarcity creates time constraints.
Example phone call:
“This is your bank’s Security Department.” “We’ve seen an unusual transaction made with your credit/debit card.” “You need to cancel this within the next 30 seconds because if you don’t cancel the money will be sent off-shore and we can no longer get it back.” “Can you read me the number off the SMS — now?”
When we feel artificially rushed, thinking becomes a luxury, panic takes over.
Thirty seconds — That’s the key piece of information. If you had five minutes, you’d hang up, go to your banking app, and then call the bank’s fraud line. And before long you would find this was a scam. But you do not have five minutes; you have thirty seconds. The adrenaline hits your body; tunnel vision sets in; and you are desperate to protect your money. You give them the code number. The game is over.
Hadnagy’s Rule: Any time someone makes a request for you to take an action on something immediately will be a 99% sign that there is an attack occurring. A real security solution should never create a sense of urgency.
5. Social Proof: The Herd Instinct
“everyone is running—so am i” if you’re standing in front of two restaurants, one with a line out the door and the other completely empty which one do you choose? The one with the line. We assume the crowd can’t be wrong.
A haker tells the victim: “i’ve already spoken to your department head petro ivanovich and with the chief accountant Maria; they approved the software update but are in a meeting right now. They said grant access while they’re busy.”
And just like that responsibility shifts. Someone else has already decided. You’re just following along.
You hear familiar names. You hear that “others have already agreed.” Your sense of responsibility dissolves. “Well, if Petro Ivanovych is aware of it… who am I to argue?” The burden of making a decision is lifted from your shoulders. You’re just doing what everyone else is doing.
Trilogy Conclusion: How Not to Become a Victim
We’ve come a long way. We’ve looked at techniques that are, to be honest, very disturbing and sometimes it feels like there is nothing you can do to protect yourself from hackers. They seem to know us better than we know ourselves.
Christopher Hadnagy did not write this book so that people will stop trusting each other and turn into paranoids. He wrote it so we will have awareness of how social engineering works and what you can do to protect yourself.
You may not be able to control what a hacker does. But you can control how you react. And the three simple rules above are your main shield:
-
PAUSE. When somebody is trying to get under your skin — emotionally speaking — pity, fear, greed, urgency — stop. Just tell yourself “stop.” Take an inhalation. Take an exhalation. Emotions only last for seconds. If you wait out the first wave of panic then logic will start to return online.
-
VERIFY. “trust, but VERIFY” — someone calls claiming to be your bank? Say “i’ll call you back.” Hang up and dial the number on the back of your card. Your boss calls from a number you don’t recognize? Ask them a question only they could know.
-
SKEPTICISM. Ask yourself one question — why does this person want me to do this? Why is this stranger been so kind to me? Why is my boss calling on a Friday night? Why is someone offering me an iphone for half price? Free cheese exists only in a mouse trap — and you are not a mouse.
Social engineering isn’t magic — it’s a science of exploiting our automatic reactions. Now that you know how people try to pull the stings on you — you can cut the strings. Take care of yourself. Protect your data. And please — think twice before opening the door for someone carrying a heavy box.
