How Attackers Manipulate Human Psychology Instead of Breaking Through Technical Defenses

UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 4.2 Free with a free account

How Attackers Manipulate Human Psychology Instead of Breaking Through Technical Defenses

Ethics in Technology · Chapter 4: Manipulation, Surveillance, and the Laws That Govern Digital EavesdroppingSection 4.2 · lesson 14 of 11611 min · free with a free account

← Deceptive Emails and Messages Designed to Trick You into Giving Away Sensitive InformationNext lesson: The Unique Risks That Come with Sharing Information on Social Media Platforms →

Earn 3 college credits for Ethics in TechnologyRecommended for credit by NCCRS · Computer Science 195 · self-paced · one payment, lifetime access
Enroll in Ethics in Technology · $250 →Download the syllabus (PDF)

In this lesson

Recognize pressure without abandoning helpfulness or trust.

  • Define social engineering and its pattern
  • Identify 6 psychological levers
  • Compare 4 common techniques
  • Apply pause, notice, verify, and decide

Free study notes

Get this lesson's notes by email

The key points and 4 practice questions with answers, in your inbox. One email, free.

One email. Unsubscribe in one click.

Transcript

Everything said in the video, section by section (1,453 words). Read along, or search it.

Chapter 4

Social Engineering and Human Psychology

Social engineering manipulates people, seeking information, money, or access they would normally protect. The request can arrive through a message, call, tempting object, or person at a door. It often exploits valuable qualities, including helpfulness, trust, and respect for expertise. That means being targeted does not establish that someone is careless or unintelligent. This lesson identifies six psychological levers, that can make an unusual request feel compelling. We distinguish those levers from four techniques, used to create the situation around the request. Authority, urgency, scarcity, reciprocity, liking, and social proof can appear together. Pretexting, baiting, quid pro quo, and tailgating describe different setups, rather than identical emotional pressures. A practical routine slows the decision, through pausing, noticing, verifying, and then deciding. The goal is to preserve helpfulness, while checking requests that would cross an important boundary.

Social Engineering

A Normal Human Instinct Can Be Exploited

Strong technical safeguards do not remove every opportunity, to influence a person's decision. An unauthorized request can appear to come from someone, who legitimately belongs inside the process. The source describes a recognizable pattern, beginning with familiar information about names, roles, or habits. Those details can make the next story feel plausible, without proving the requester's identity. A hook introduces a message, explanation, or object, that draws the recipient's attention. Pressure then encourages action, through fear, authority, trust, reward, or curiosity. The requested action might disclose information, authorize money, open content, or admit someone through a door. The resulting access can then be used, for a purpose the recipient never intended. Recognizing this pattern is useful defensively, rather than assuming every attack follows an identical sequence. The key opportunity is the decision point, where an independently verified process can interrupt the manipulation.

6 Levers

Identify What Is Making the Request Feel Compelling

Authority draws on respect for power or expertise, such as a finance director or support role. Notice when that apparent authority asks you, to skip the process normally required. Urgency creates time pressure, reducing the opportunity to consider or verify the request. Scarcity makes an opportunity seem rare, encouraging action before the limited supply disappears. Reciprocity draws on the wish to return a favor, even when the favor was small. Liking encourages cooperation with someone who feels friendly, familiar, or similar to you. Social proof suggests that other people complied, making the same action appear ordinary or expected. An unverified claim about everyone else is still a claim, rather than independent evidence. None of these tendencies is inherently harmful, because they also support everyday cooperation. The warning comes when they push someone toward unusual disclosure, payment, or access without verification.

Combined Pressure

Urgency Concerns Time; Scarcity Concerns Availability

Urgency concerns time, while scarcity concerns how much of something appears to remain available. A demand to act within one hour is urgency, even if no limited quantity is involved. An offer claiming only three places remain is scarcity, even without a precise deadline. The source's fictional IT email combines several cues, rather than relying on one lever alone. It claims security-desk authority, and threatens an account lock within sixty minutes. It says most of the team completed the check, adding a claim of social proof. Few remaining verification slots add scarcity, while a personal greeting and thanks encourage liking. The familiar tone can make the combined story feel normal, despite its unusual request. Its sender also fails to match the company's known domain, which provides another reason to check. Recognize the combined pressure, then verify through a channel outside the message itself.

Pretexting

A Plausible Role Is an Invented Reason to Ask

Pretexting uses an invented role or story, providing an apparently reasonable explanation for a request. The person might claim to be a new employee, an auditor, or a bank officer. Real names and job titles can be copied from public material, making that explanation feel familiar. That familiarity does not prove authorization, to receive the information or access being requested. The source's Twitter example concerns July two thousand twenty, when employees received deceptive phone contact. The callers posed as internal IT, and the resulting compromise affected high-profile accounts. The company's historical account identified phone spear phishing, rather than a failure to break encryption. The defensive lesson is to test the identity independently, instead of trusting the claimed support role. Asking the same requester for proof can leave you, inside a story they control. Use a known official contact or process, before allowing the requested access.

Baiting

Temptation Can Lead Toward Unsafe Content

Baiting uses a tempting object or download, encouraging the recipient to interact with it. The source's physical example is an unknown drive, labeled with intriguing salary information. Curiosity can make opening its contents seem useful, before the device's origin is considered. An online example advertises desirable content, through an unofficial download that may contain harmful software. This does not mean every free service or download is malicious, because legitimacy depends on the actual source. The source cites a two thousand sixteen Illinois study, involving about three hundred dropped drives. Nearly half were connected and files opened, demonstrating substantial interaction with unknown devices in that setting. Connecting a device or opening its content can create exposure, without every unknown drive automatically causing infection. Do not investigate a found drive on your own computer, or assume its interesting label makes it safe. Use the approved found-device process, preserving the boundary between curiosity and untrusted content.

Quid Pro Quo

An Offered Service Can Hide a Demand for Access

Quid pro quo means something for something, involving a supposed exchange rather than an isolated tempting object. The requester offers help or a benefit, then seeks information or access in return. The source describes supposed support, offering to fix a slow computer before asking for a password. Another request might seek remote access, presented as a necessary part of the offered repair. The exchange can feel reasonable, particularly when the person already wants the problem resolved. It can also use authority, reciprocity, and a false support identity at the same time. Baiting instead encourages interaction with a tempting object or content, without the same direct service exchange. The techniques can overlap, so classifying the example is less important than recognizing the boundary being crossed. Do not disclose a password to an unsolicited caller, merely because help has been offered. Contact support through its known official channel, and follow the authorized process for any assistance.

Physical Access

Tailgating Uses Courtesy to Bypass an Entry Check

Tailgating concerns physical entry, when someone follows an authorized person through a secure entrance. The person may carry boxes, wear a delivery uniform, or move confidently behind a group. Those cues encourage courtesy or familiarity, without independently establishing the right to enter. The source uses piggybacking, when an authorized person knowingly lets the other person inside. Either situation can bypass the intended check, performed through badges or reception procedures. An access-control system can therefore be undermined, even while its lock operates correctly. The practical response is to preserve the normal entry process, rather than infer authorization from appearance. Visitors can be asked politely, to use their own badge or check in at reception. Courtesy and a clear boundary can coexist, when the process is explained consistently. The same lesson connects physical and digital access: a plausible request still needs the appropriate verification.

Response Routine

Pause, Notice, Verify, and Decide

The response routine begins with pause, especially when the request is unexpected or unusually sensitive. Take enough time to notice the situation, rather than treating pressure as a reason to bypass checks. Second, notice whether you feel rushed, flattered, frightened, or indebted to the requester. Those feelings can be signals, that a psychological lever is influencing the decision. Third, verify through a number, website, or procedure you already know or independently establish. Do not rely on the suspicious request's own link, reply address, or telephone number for that check. The independent channel takes the decision outside the explanation, supplied by the possible attacker. Fourth, decide only after the request is confirmed, and follow the normal authorized process. The same sequence applies to emails, texts, phone calls, and requests at a building entrance. It slows the unusual decision, while allowing legitimate assistance to continue through a reliable channel.

Questions to Ask

Turn Each Feeling of Pressure Into a Check

For authority, ask whether the role would genuinely request contact this way, or bypass the normal process. For urgency, ask what actually happens, if you take ten minutes to verify. For scarcity, ask whether you requested the offer, and whether missing it truly matters. For reciprocity, ask whether a favor is being used, to create a debt involving sensitive access. For liking, separate knowing the person, from merely feeling familiar or similar to them. For social proof, seek confirmation from someone trusted, rather than accept the requester's claim about other people. These questions turn a feeling of pressure, into a concrete opportunity for checking. The aim is not blanket distrust, because normal cooperation remains valuable in work and daily life. The aim is recognizing unusual action, urged through pressure, flattery, fear, or a persuasive story. Pause, notice, verify, and decide, preserving both helpfulness and the boundaries that protect information and access.

About Ethics in Technology at UPI Study

Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses

Compare: Cybersecurity vs Ethics in Technology · Which ethics course?

Why take it here

Why students take Ethics in Technology with UPI Study

The right and wrong of the digital worldEthics in Technology looks at the choices technology forces on people and organizations: security and privacy, surveillance and the law, big data, hacking and cyber warfare, malware and breaches, intellectual property, cybercrime, encryption, artificial intelligence and responsible digital citizenship. It suits computer science, information technology and business degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About How Attackers Manipulate Human Psychology Instead of Breaking Through Technical Defenses

What is social engineering in cybersecurity?
Social engineering is manipulating people, rather than breaking technical defenses, to obtain information, money, or access they would normally protect. Attackers often gather familiar details, add a hook such as a message or object, then apply pressure through fear, authority, trust, reward, or curiosity. It exploits good qualities like helpfulness and respect for expertise, so being targeted does not mean someone is careless or unintelligent.
What psychological triggers do social engineers use?
Six common levers are authority, urgency, scarcity, reciprocity, liking, and social proof, several of which match principles Robert Cialdini described in his 1984 book Influence. Authority leans on respect for a boss or expert, urgency creates time pressure, scarcity makes something seem rare, reciprocity uses the urge to return a favor, liking exploits friendliness, and social proof claims everyone else complied. They signal danger when they push someone to skip verification.
What is the difference between pretexting, baiting, and quid pro quo?
Pretexting uses an invented role or story, such as a fake auditor or IT staffer, to justify a request. Baiting uses a tempting object or download, such as a found USB drive labeled with salary information. Quid pro quo offers help in exchange, like fixing a slow computer before asking for a password. In a 2016 University of Illinois study, people plugged in nearly half of about 300 dropped drives and opened files.
What is tailgating in physical security?
Tailgating is following an authorized person through a secure entrance without using your own access, often while carrying boxes, wearing a delivery uniform, or walking confidently behind a group. When the authorized person knowingly lets someone in, it is often called piggybacking. Either way, a working lock is bypassed. The defense is keeping the normal entry process, politely asking visitors to use their own badge or check in at reception.

About the Ethics in Technology course

How many college credits is Ethics in Technology?
Ethics in Technology (Computer Science 195) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Ethics in Technology cost and what is included?
$250, paid once, with lifetime access: all 116 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. It is sold on its own and is not part of UPI Study PRO.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Ethics in Technology take?
It is self-paced with no deadlines. The 116 lessons total about 28 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Ethics in Technology.

116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Ethics in Technology →Download the syllabus
Ethics in Technology
3 credits · NCCRSEnroll →