Psychological Tactics Used by Phishers

There's an undeniable pattern in social engineering scams. Recently, I've been reviewing years of social engineering cases I've investigated and #vishing or #smishing were most often the initial contact methods. The variety of victims' actions was staggering: - wire transfers - #Zelle - #CashApp - #Paypal - #Venmo - #Remitly - physical handoffs to fake agents - investments on phony platforms - #crypto ATMs - mailing cash - unknowingly using Uber/Lyft drivers as money mules The impersonations covered a spectrum of perceived authority: banks, law enforcement, FedEx/UPS, government officials, tech support, celebrities, firefighters, lawyers, corporate executives/managers, and utility companies. Here's the point every single case had in common, regardless of the tactic or outcome: The criminals successfully exploited two simple psychological levers: Authority and then Urgency/Fear. They weaponized the internal trust we automatically assign to positions of power (a 'bank representative' or 'law enforcement officer'). Once the victim accepted the impersonation, the script flipped to crisis mode. The underlying messaging, stripped down, was always one of two things: 1️⃣ "There is a problem and I can help you, but we have to do it now." (Threat/Urgency) 2️⃣ "I have a problem and I need you to help me." (Appeal to Empathy/Authority) This isn't about sophisticated hacking. It’s about human manipulation—and in the digital age, this manipulation has become easier to deploy at scale. The barrier to entry for a scammer is a phone and a script, not a zero-day exploit. This realization underscores a crucial truth for security professionals and organizations: Scam prevention and social engineering education is more vital than the next device update or firewall configuration. A strong technological defense is necessary, but it is ultimately bypassed when a criminal can simply trick an employee or customer into willingly sending money or providing credentials. The human element is the weakest link, but also the strongest line of defense if properly fortified. ✅ Protects Personal Finances: Directs resources away from remediation and toward proactive defense of user assets. ✅ Increases Revenue (Business Impact): Cuts down on massive financial losses from wire fraud, invoice modification, and BEC attacks, directly impacting the bottom line. ✅ Can Even Save Lives: In scams involving physical harm threats or emotional distress (like grandparent scams), education can prevent catastrophic emotional and psychological fallout. We need to invest in transforming automatic trust into critical thinking. The best security patch is an educated mind that knows how to spot the Authority/Urgency pivot. What is one real-world example of social engineering you’ve seen that relied purely on these two tactics? Share your thoughts below. #Stopthescam before it starts! Fraud Hero #PauseThinkVerify #fraudprevention #FraudHero

Phishing has evolved (again) – and it’s more dangerous than ever. It's been some time already since we've seen badly written emails (thank you, LLMs) and broken templates (those get filtered) — but cybercriminals have leveled up again. Instead of sending one-off emails, attackers now engage in long-term conversations to build trust before striking. 🔹 They don’t ask for your password right away. Instead, they chat with you for days or weeks. 🔹 They impersonate recruiters, journalists, or colleagues offering jobs, business deals, or exclusive opportunities. 🔹 They spread malware through LinkedIn, WhatsApp, SMS, and email. No more sketchy links—these messages sound real. 🔹 They use social engineering tactics (fear, urgency, curiosity, authority) but stitch it in a broader discussion strategy to build rapport. This isn't speculation—it’s happening right now. The I-Soon leaks, which exposed how a Chinese cyber contractor targeted governments and businesses, revealed that prolonged social engineering is now a core hacking strategy. And it’s not just nation-states (or sponsored contractors) doing this. A recent SlashNext report found that text-based and BEC attacks are growing heavily. It's now representing 70% of the total phishing volume. Phishing is no longer just an email problem—it’s happening in your LinkedIn DMs, WhatsApp chats, and SMS inbox. You should start training your people against those and mix it up with your tried and true credential harvesting simulation. #phishing #socialengineering

It’s not paranoia if they really are out to get you. And guess what? They are. While you’re busy worrying about VPNs and password policies, scammers are sliding into your employees’ DMs with sweet nothings, fake job offers, and “just one click” crypto deals. Welcome to the trifecta of human-targeted scams: - Romance - Recruitment - Financial fraud They don’t need root access if they’ve already got your heart, your résumé, or your retirement account. Are you protecting your people? Not just their inboxes. Them. Here’s what you’re up against: ❗Deepfake-enabled fraud: $200M lost—in just one quarter of 2025 ❗AI-generated crypto scams: $4.6B stolen in 2024—up 24% ❗Over 50% of leaders admit: no employee training on deepfakes ❗61% of execs: zero protocols for addressing AI-generated threats Companies spend millions locking down endpoints—then leave their employees to get catfished by a deepfake on Tinder. But here’s the good news: you’re not powerless. You just have to stop pretending a phishing test is a strategy (please). Here’s how to actually reduce risk: ✔️Make your training real. Include romance bait, fake recruiters, and deepfake voicemails. If your simulations don’t mirror reality, it’s not training—it’s theater. ✔️Train managers to notice when something’s off. Isolation. Sudden secrecy. Financial stress. These aren’t just HR problems—they’re prime conditions for social engineering. ✔️Build a culture where it’s safe to ask, “Is this sketchy?” If your people feel dumb for asking, they’ll stop asking—and that’s how scams slip through. ✔️Partner with HR. Online exploitation, financial manipulation, digital coercion—these are wellness issues and security issues. Treat them that way. ✔️Empower families, not just employees. Scams often hit home first. Make your materials so good they want to send them to their group chat. Bonus: they’ll bring those healthy habits right back to work. When you protect the human—not just the hardware—you don’t just lower risk. You build trust. And for the record? Paranoia gets a bad rap. Sometimes it’s just pattern recognition. #Cybersecurity #HumanRisk #AIThreats #Deepfake #RomanceScams #AI #RecruitmentFraud #InsiderThreat #Leadership #DigitalWellness #SpycraftForWork

I've spent years arguing that attackers target psychology, not just systems. Most of the industry nodded. Then went back to running phishing simulations and tracking completion rates 🥲 Researchers at Sensity AI just documented over 1,000 AI-generated deepfake videos being used in the Russia-Ukraine conflict - fake soldiers, fabricated from real footage, targeted at civilians in both countries to erode trust and undermine judgment. Not mass propaganda: 🎯 Precision targeting. 📇 Content built from real identities, designed to make certain people question what they see and who they believe. That methodology does not stay in conflict zones. The same logic lands in corporate inboxes every day: 🕵 Profile the individual. 📖 Understand what they fear or trust. ✅ Build something credible. ⏱️ Time it well. 🧑🏼💼 A CFO gets a message that sounds like the CEO, timed to a stressful quarter close. 🧑💻 A developer gets a phishing link disguised as a code review request. 🎙️ A HR manager gets a deepfaked voice note from someone who sounds exactly like a colleague. When an adversary (state or criminal) wants to destabilise a target, they don't always go for the infrastructure first. They go for the people. 1 at a time, at machine speed, calibrated to what each person is most likely to believe. Your most at-risk employee is not the one who failed your last phishing simulation. It is the one who is most targeted, most pressured, and least supported. ‼️ THESE ARE NOT THE SAME PERSON ‼️ and most security programs cannot tell the difference. That is the gap we have not closed. Not for lack of effort. For lack of the right tools.

As Incident Responders, we’re seeing an increase in attacks using classic smokescreen tactics, so I thought I’d share a few snippets that hopefully help you stay safe! The initial point of compromise is a phishing email. Nothing particularly sophisticated, just well-timed and well-crafted enough to have a target team member enter their login credentials into a spoofed site and prompt them for their MFA token. If all runs smoothly, for the bad eggs, the attackers are able to successfully proxy the MFA response, intercept the session token, and then bypass the victim’s “super secure” two-factor authentication. They use a real-time phishing kit like Evilginx2, which allows them to ride in on the back of a legitimate login session. So no brute force, no malware dropper, no obvious indicators until it’s too late. Once inside, the attackers monitor for an opportune time to strike, typically when a large payment is to be sent or due. They modify the payment instructions of one of the parties to make payment to a mule account they control. But they didn’t stop there! In order to mask their activity, because multiple users within the authorisation chain are on CC to the payment instruction, they launch a classic smokescreen campaign by flooding every inbox at the firm with hundreds of spam messages at the exact same time the crime is being committed. And this is ongoing and relentless.  The goal is simple: bury the wire transfer confirmation email in noise so it won’t get seen or detected, delaying any potential mitigation action. Effectively, the bad eggs are throwing a digital smokescreen. It worked. And is working across a multitude of cases we’ve seen. The transfer goes through, unnoticed, and the funds are gone before a team even has a chance to react.  Urgently add active monitoring for behavioural anomalies post-authentication, such as impossible travel, sudden privilege escalation, or new device profiles making high-value changes. Otherwise, you’re flying blind. For payment authorisation, MFA is not a panacea, especially for email accounts handling payment instructions. Implement manual processes to double and cross-check payments. Or reach it if you want to hear more about an automated payment protection solution we’ve built that fixes this. Not in full release but we’d love to hear your thoughts as we build it out. Stay sharp out there.

They thought it was Netflix. Turns out, it was the most expensive R199.99 they’d ever spend. It looked perfect. Same logo. Same fonts. Same friendly tone. “Your banking info is about to expire. Update your card to avoid suspension. Payment due: R199.99.” No reason to doubt it. They clicked. Entered their details. Approved the push. Minutes later — R19 999 gone. That’s the thing about phishing: It doesn’t need malware. It just needs emotion. Because hackers don’t start with code. They start with psychology. They pull two invisible strings: → Fear of losing something you value → Urgency to act before you think And when both hit at once — logic shuts down. I’ve seen this pattern countless times. Different brands. Same trap. That’s why awareness isn’t about memorising policies. It’s about emotional control under pressure. Next time something feels urgent, use the PTV Rule: 1. Pause – step back for 30 seconds. 2. Think – who benefits if I act fast? 3. Verify – never through the link; go directly to the source. You don’t need to be a cybersecurity expert. You just need to slow down long enough to see the setup. Because hackers don’t hack systems, they hack people. And they’re counting on you to click before you think.

They didn’t fall for the phishing email because they were stupid. They fell because it was human to do so. Maybe they were rushing between meetings, maybe the email came from someone they trusted. Maybe the subject line triggered a sense of urgency or fear or maybe, just maybe, they were trying to help. We talk about phishing as if awareness is all it takes. But in reality, phishing exploits emotions, not just ignorance. It leverages pressure, it mimics authority, it builds trust before betrayal. And here's what leaders often get wrong: They shame the victim instead of investigating the conditions that made the deception successful. A person under stress will click. A person working in fear will obey. A person with no training will improvise. If you want fewer phishing victims, don’t just secure the inbox, secure the culture. Create a no-blame environment Train for emotion-driven deception, not just obvious red flags Give people psychological safety to report mistakes Because cybersecurity isn’t just about tools. It’s about humans and how they think under pressure. 🔗 Follow me, Tolulope Michael, for more. #Tolulopemichael #ThoughtLeader #CyberSecurityAwareness #HumanFactors #PhishingAwareness #LeadershipDevelopment #WorkplaceCulture #EmotionalIntelligence #CybersecurityTraining #SecurityCulture

Here’s How Scammers Use Psychology to Steal Your Money “[E]xperts are warning consumers to stay vigilant against scams. Martina Dove PhD, who leads product research and behavioral science at Charm Security, emphasized the dangers of AI-generated scams. She’s authored a book on the topic, The Psychology of Fraud, Persuasion and Scam Techniques. ‘You know, deep fakes. You can hop on a call with somebody, and they can be on a video with you, and you think it’s the real person. They can disguise their voice. They can disguise the video and apply a different face,’ said Dr. Dove. …AI has made it increasingly difficult to distinguish between real and fake, as seen in AI-generated videos falsely featuring celebrities like Kelly Clarkson (“No, Kelly Clarkson is not selling gummies on your Facebook feed; it’s a deepfake” https://lnkd.in/gpfpTPEx). Scammers often use psychological tactics to target vulnerable individuals. One such scam involves offering work-from-home jobs to those struggling to find work or are limited in the times they can work. ‘It appeals to people that can only work part time,’ Dr. Dove said. ‘Maybe they have to care for relatives or children. So, it’s targeting very specific people that may have difficulty finding other roles.’ In a recent investigation, Dewberry demonstrated how scammers offer free training for fake crypto-mining jobs. ‘That’s also a technique called commitment. A lot of the time the scammer just wants to get you in a conversation,’ Dr. Dove said. Scammers often create fake websites that appear legitimate. ‘Even just creating these prototypes these fake websites where you would have to hire a designer and developer. It can be done really easily with these prototyping tools that are AI generated,’ said Dr. Dove. Despite the risks, Dr. Dove highlighted that AI can also be used to identify scams. ‘Use generative AI to your advantage, right. Run the message through Chat GPT and see what Chat GPT thinks about it,’ she said.” https://lnkd.in/gTrYM_bW

How Hackers Steal Your Data Without You Realizing It It all starts with one email. You click. You think it’s your bank, your HR team, or your delivery company. But it’s not. That single click can change everything. Here’s how phishing really works (step-by-step): 1️⃣ The attacker sends a phishing email  it looks 99% real. 2️⃣ The victim clicks the fake link and lands on a clone website. 3️⃣ The hacker collects credentials (username, password, maybe even 2FA codes). 4️⃣ Within seconds, the attacker logs in to your real account — and you’re locked out. →Hacker: The hunter. →Target: The unaware. →Phishing Website: The trap. →Original Website: The real destination you never reach. Why this still works in 2025: Because phishing doesn’t hack systems  it hacks humans. It’s not about breaking code. It’s about breaking trust. Even the smartest professionals fall for phishing because hackers no longer look suspicious. They look authentic. ✅ Protect yourself: ↳Always check the sender’s email domain ↳Never enter passwords from an email link ↳Use MFA (but be alert for push-bombing attacks) ↳When in doubt  verify through a separate channel Phishing doesn’t start with technology. It starts with psychology. Have you ever seen a phishing email that almost fooled you? Follow Marcel Velica for more cybersecurity insights, awareness posts, and real-world protection tips. Share this post  you might protect someone from the next phishing trap.