July 15, 2020. A 17-year-old named Graham Ivan Clark is sitting at a computer in Tampa, Florida. He and two accomplices have spent the past several days on something big. It would soon compromise the accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Apple, Uber, and Kanye West at once.
They hadn’t written a single line of exploit code. They hadn’t found a zero-day. They hadn’t breached Twitter’s systems with any kind of technical sophistication at all.
They called a few Twitter employees on the phone.
Clark and his team had researched Twitter’s internal structure on LinkedIn. They harvested employee names, department titles, and the internal jargon of Twitter’s IT and support teams. Then they started calling, posing as IT staff conducting a VPN credential check. That is the kind of routine thing real IT departments do, especially during the early work-from-home chaos of the pandemic. The employees they reached had no specific reason to be suspicious. The callers knew the right words. They sounded like colleagues. Within hours, the attackers had access to Twitter’s internal admin panel.
By the afternoon of July 15, they were posting Bitcoin scam messages from the verified accounts of the most recognisable people on the planet. They made $120,000 in Bitcoin before Twitter’s engineers could lock down posting entirely. Clark was arrested weeks later. He was 17.
There was no malware. No exploited server vulnerability. No sophisticated technical attack. Just a phone call, some research, and an understanding of how people make decisions under pressure.
The short answer. Social engineering is manipulating a person into an action they wouldn’t otherwise take, usually to hand over credentials, money, or access. It works through documented psychology, not code: authority, urgency and fear, pretexting, reciprocity, liking, social proof, and consistency. The tells are consistent. You feel rushed, you feel scared, or someone asks you to skip normal process. The one defense that reliably works is verification through an independent channel. Hang up and call back on a number you find yourself, before you comply with any request involving credentials, money, or remote access.
What social engineering actually is
The phrase “hacking humans” gets used a lot, and it’s both accurate and slightly misleading. It’s accurate in the sense that social engineering does exploit people rather than software. It’s misleading because it implies something vague and instinctive — like con artistry that works through natural charm.
Social engineering in practice is more systematic than that. It’s the deliberate application of documented psychological principles to get someone to take an action they otherwise wouldn’t. The principles aren’t secret. Most of them were catalogued publicly in 1984, when a psychology professor named Robert Cialdini published a book called Influence: The Psychology of Persuasion.
Cialdini wrote the book to explain how marketers, salespeople, and advertisers get people to say yes. He identified six core principles — authority, social proof, scarcity, reciprocity, liking, and commitment/consistency — that reliably override critical judgment and produce compliance. The book was an academic contribution to consumer psychology. Attackers use it as a manual.
Scattered Spider, the English-speaking hacker collective responsible for the 2023 MGM Resorts attack, were fluent in all six principles. So was the teenager who compromised Twitter in 2020. So is the person who will call your company’s help desk next month pretending to be an employee locked out of their account before an important presentation. Understanding what these principles are and how they work on you is the only meaningful defense.
Authority: the principle attackers use most
This principle has a long research pedigree. Forty years before Graham Clark called Twitter employees, a Yale psychologist named Stanley Milgram ran a series of experiments. They disturbed everyone who studied them. Milgram told volunteers they were participating in a study on learning and memory. He put them in a room with an authority figure, a man in a lab coat. He told them to administer electric shocks to a subject in an adjoining room whenever that subject answered a question incorrectly. The shocks weren’t real, but the volunteers didn’t know that. They could hear what sounded like escalating screams through the wall.
Milgram wanted to know how far ordinary people would go when instructed by an authority figure. The answer disturbed him. In his original 1961 study, about 65% of subjects administered what they believed to be the maximum shock of 450 volts. They did it simply because the man in the lab coat told them to continue. They were visibly distressed. They wanted to stop. But the authority said keep going, and most of them did.
Social engineering runs on this mechanism. Picture a caller who tells a help desk representative three things. They’re from corporate IT. A security incident is in progress. And they need an account reset immediately. That caller is triggering the Milgram effect. The authority doesn’t need to be real. It just needs to feel plausible. “Microsoft Support,” “your bank’s fraud department,” “the IRS,” “a senior manager from regional leadership”: none of these claims require verification to produce compliance. We are socially conditioned to treat perceived authority as sufficient grounds for action.
In September 2023, Scattered Spider called MGM Resorts International’s IT help desk. The callers were young — mostly teenagers and people in their early twenties, British and American, none of them professional criminals in any traditional sense. They impersonated MGM employees, claimed they were locked out of their accounts, and used enough internal-sounding language to be convincing. Help desk staff reset their credentials. Those credentials gave the attackers access to MGM’s systems, from which they deployed ransomware and disrupted hotel and casino operations across the country. MGM’s reported losses were approximately $100 million.
The authority wasn’t real. The compliance was.
Urgency and fear: bypassing your own judgment
Your brain has two roughly competing systems for decision-making. One is slow, deliberate, and analytical — it considers options, weighs risks, and notices when something doesn’t add up. The other is fast, instinctive, and emotional — it reacts to immediate threats and gets you moving before you’ve finished thinking.
Urgency activates the fast system and suppresses the slow one. This is adaptive: if a car is swerving toward you, you don’t want to be running a risk analysis. You want your body moving before your conscious mind has processed the situation.
Attackers engineer urgency deliberately because they know what it does to judgment. “Your account will be suspended in 24 hours.” “We’ve detected suspicious activity and need to verify your identity immediately.” “There is an active warrant for your arrest.” “Your computer is infected and the damage is spreading right now.”
None of these statements are true. But the fear response they trigger is real, and once fear is active, your capacity for critical evaluation drops substantially. A person deciding whether to comply with a request in 30 seconds makes very different decisions than a person who takes 30 minutes to verify.
The IRS phone scam is a clean example. Callers impersonating IRS agents tell targets that they owe back taxes. Pay immediately or face arrest, they say. Payment is typically demanded via gift cards, wire transfer, or cryptocurrency. The IRS does not call people at home and demand immediate payment. The IRS sends letters. But the combination of fear (arrest), authority (federal agency), and urgency (right now, today) is powerful enough that thousands of people comply every year. The FBI’s Internet Crime Complaint Center reported that government impersonation scams caused losses of over $650 million in the United States in 2023.
The signal to look for is the one you’re trying not to notice. When you feel rushed, when you feel scared, when you feel you must act now or something terrible will happen: that is precisely when you should slow down. Urgency engineered by someone asking for your credentials or money is not a reason to act faster. It is a reason to stop.
Pretexting: building the story that makes the ask feel natural
A pretext is a constructed backstory that frames a request in a way that makes it feel normal. It explains who the caller is, why they’re asking, and why the unusual nature of the request is perfectly reasonable under the circumstances.
“Hi, this is James from the IT security team. I know this is a bit unusual, but we’ve had an incident on the network and we’re doing emergency credential verification for anyone who accessed the VPN in the last 48 hours. I’ve got you on the list — can you confirm your current password so I can verify you weren’t affected?” That’s a pretext. It creates an identity (IT security team), a situation (network incident), a reason the request is legitimate (verification), and a reason the request needs to happen right now (emergency).
The pretext also does something subtler: it makes the target feel helpful rather than victimized. You’re not giving away your password. You’re participating in an incident response. You’re doing the right thing by cooperating with IT.
Scattered Spider built pretexts by researching targets on LinkedIn before calling. They knew which tools the company used, which departments existed, what internal processes looked like. That knowledge made their pretexts convincing enough to work even on people who would have been skeptical of a less informed caller.
In a separate 2022 incident, Scattered Spider targeted Okta, the identity management company, using a pretext about being locked out of a Sams Club account and needing help resetting access. The pretext got them far enough that Okta later issued a public statement acknowledging the incident. The attackers weren’t technical geniuses. They were good at building stories.
Reciprocity: the obligation they create before the ask
Cialdini’s research on reciprocity documented something uncomfortable: people feel strongly compelled to return favors, even small ones, even unsolicited ones. If someone does something for you — anything — you feel a social obligation that is genuinely difficult to ignore. This is the mechanism behind supermarket free samples and unsolicited gifts from charities. It’s also the guilt you feel when someone holds a door open and you don’t say thank you fast enough.
Social engineers exploit this by helping you before they ask for anything.
The support call that starts by resolving your problem — a fake problem they manufactured, or a real inconvenience they’re now “fixing” for you — is building a debt. By the time the ask comes, you feel obligated. You’ve already accepted something from them. You owe them.
This is the mechanism behind many long-form fraud operations. Pig butchering scams, to use the ugly but accurate name, involve months of relationship-building, usually over messaging apps, before any financial ask appears. The fraudster invests genuine time and apparent care. They ask about your life. They remember details from previous conversations. They send thoughtful messages. They seem to like you. By the time the conversation turns to a cryptocurrency investment platform they’ve apparently been doing very well with, you feel you know this person. They’ve invested in you. And you feel, without quite being able to articulate why, that you’d like to give something back.
Liking and social proof: the less obvious ones
People comply more readily with requests from people they like. This is so obvious it sounds trivial, but it has real operational implications for social engineering.
Attackers who research their targets learn what they can about preferences, interests, and social connections. They note the college you went to (LinkedIn), the sports team you follow (Twitter activity), the mutual connections you share. In a call or a message, finding common ground — “Oh, you went to Michigan? My sister actually went there” — creates a warmth that lowers guard. It seems irrational. It is irrational. It works anyway.
Social proof is subtler still. Cialdini identified it as the principle by which people look to the behavior of others to decide what’s appropriate in unfamiliar situations. “Everyone on the team has already verified their credentials — you’re the last one on the list” isn’t just urgency. It’s social proof. It implies that compliance is the normal, reasonable, collectively endorsed action, and that refusing would be the aberration.
In a phishing context, social proof shows up as apparent legitimacy signals — the professional logo, the formal language, the signature block that matches real company communications. None of these things indicate that an email is authentic. They indicate that it looks like what authentic emails look like. That triggers social proof reasoning: this looks like what I’d expect from a real communication, so it probably is one.
Commitment and consistency: the series of small yeses
Once you say yes to something small, you’re more likely to say yes to something larger and related. This is the foot-in-the-door effect. It works because people are motivated by consistency. We want our actions to align with our stated positions and our previous decisions. Having agreed once, we feel a quiet internal pressure to keep agreeing. Refusal would require admitting that we shouldn’t have agreed the first time.
Attackers use this across extended fraud operations. The first request is small and harmless — a piece of information that seems innocuous, a minor favor, a quick verification step. Each subsequent request escalates slightly. By the time the ask is significant, the target has already said yes to ten preceding requests and the eleventh feels like a continuation rather than a violation.
The same principle runs in reverse when attackers pressure help desk staff. A support worker who has already confirmed your name and employee ID to a caller has made two small commitments to the interaction being legitimate. When the request for a password reset comes, reversing course means implicitly accepting that the preceding confirmations were a mistake. Consistency pressure makes that difficult.
Kevin Mitnick and Frank Abagnale: the human side of the record
No discussion of social engineering is complete without Kevin Mitnick. He spent much of the 1990s as the FBI’s most wanted computer hacker. In interviews he was consistently clear that most of his successful intrusions relied more on social engineering than on technical exploitation. He would call company employees, pose as co-workers, and extract internal phone numbers and department structures. He then used that information to build more convincing pretexts for the next call. His autobiography, The Art of Deception, is an operational guide to the discipline.
Frank Abagnale is often cited in the same breath. He is the con man portrayed in the 2002 film Catch Me If You Can, and his story merits a brief note. Abagnale’s claimed exploits (impersonating a Pan Am pilot, a doctor, a lawyer) have been substantially disputed by journalists and researchers in recent years, with some reporting suggesting significant fabrication. The FBI agent portrayed in the film, Joseph Shea, has disputed the narrative. Abagnale himself has continued to claim the exploits were real. The historical record is genuinely unclear, and treating him as an authority on social engineering should be done with that uncertainty in mind.
Mitnick, by contrast, was prosecuted, imprisoned, and documented. His techniques were real. His testimony is credible. And the specific methods he described are the same ones Scattered Spider used thirty years later against some of the largest companies in the world. That is, researching targets, building pretexts, and using each successful call to make the next one more plausible.
The techniques don’t change because the underlying psychology doesn’t change.
The vishing advantage: why voice works better than text
Most phishing training focuses on email. Email phishing is common and important. But voice phishing — vishing — is significantly more effective per contact because it introduces elements that text cannot replicate.
A voice creates immediate rapport. It communicates emotion, urgency, and confidence in real time. A caller who sounds calm, professional, and slightly impatient, as though dealing with an annoying but routine process, communicates authority signals that a text message simply cannot carry. And crucially, voice creates real-time pressure that text doesn’t. You can think about an email for a few minutes. A caller is waiting.
Researchers studying accent perception have found that English-speaking targets perceive certain accents as more authoritative and less threatening in specific contexts. Some social engineering groups appear to exploit this deliberately, selecting callers for particular targets based on accent and register. Scattered Spider’s documented call recordings show callers who are fluent, unhurried, and professionally plausible.
The other vishing advantage is that it’s difficult to verify in real time. You can hover over a link in an email. You can look at a sender address. On a call, the verification options are limited. You could hang up and call back, but that feels socially awkward and implies you think the person is lying. It also takes presence of mind to do in the moment rather than after. Most people don’t hang up.
How to know when it’s happening to you
The tells are consistent across attack types, even when the specific pretext varies.
You feel urgency. Something is happening right now, and you need to act before you can think. This is the single most reliable signal that someone is attempting to manipulate you. Urgency is the attacker’s best friend and your most important warning sign.
You feel fear. Arrest, account suspension, financial loss, embarrassment — whatever the stakes are, they’re being communicated as immediate and serious. Fear and urgency work together. When you notice both simultaneously, you should be more skeptical, not less.
Someone is asking you to bypass normal process. The normal process for resetting credentials requires ticket submission, manager approval, and second-factor verification. But this is an emergency, they say, there’s no time, and they just need you to do it directly. Any request to skip the verification steps that exist specifically to prevent unauthorized access should be treated as a serious red flag.
Something feels slightly off and you can’t say what. This intuitive sense of wrongness is worth trusting. You may not be able to articulate why something doesn’t seem right, but your pattern-matching intuition has noticed a discrepancy that your conscious mind hasn’t surfaced yet. The right response is to slow down and verify, not to override the sense of wrongness because you can’t justify it formally.
Verification: the one countermeasure that actually works
Security awareness training often teaches people to “be suspicious” of unusual requests. This is reasonable advice that produces almost no behavioral change in practice, because the whole point of social engineering is that requests feel usual rather than unusual. The authority is plausible. The pretext is convincing. The urgency is real. Being generally suspicious doesn’t help when someone has done their research.
The countermeasure that actually works is specific: verify through an independent channel before complying with any request involving credentials, money, or remote access.
Hang up and call back. Not on the number the caller gave you. Use the number you find yourself, from the company’s official website, the back of a card, or an internal directory you access independently. If the situation was real, the legitimate caller will be fine with this. They’ll accept a brief delay while you verify. If they resist, that resistance is itself evidence of bad intent. Watch for pushback lines. Common ones: “there’s no time,” “calling back would compromise the investigation,” or “you’re creating a problem by following protocol.”
A legitimate company’s IT department accepts callbacks as standard procedure. A legitimate bank’s fraud team accepts callbacks as standard procedure. A legitimate HR department accepts callbacks as standard procedure. The only callers who resist verification are the ones who can’t survive it.
How organisations fail at this
The problem with help desk social engineering isn’t that the people who answer the phone are naive. It’s that the organisations they work for have built processes that trade security for customer convenience, and then extended that same convenience-optimised process to internal support.
Password resets over the phone are a default service in many organisations. The verification step — confirming identity before resetting — is often minimal: a name, an employee ID, maybe a manager’s name. All of that information is available on LinkedIn. All of it can be assembled in 20 minutes by someone who knows where to look.
The MGM help desk workers who reset Scattered Spider’s requested credentials weren’t failing at their jobs in any obvious way. They followed process. The process was the vulnerability.
Organisational defenses that actually work are structural, not just educational. They include vishing-resistant policies: no credential resets over the phone without a second verification channel the caller cannot control. They also include incident-reporting cultures that treat near-misses as valuable information rather than embarrassments to be quietly buried. A culture where employees are punished for reporting that they almost fell for something is a culture where the same attack will eventually succeed undetected.
The most effective security awareness training is based on real attack scenarios. Not generic advice about being careful, but actual recordings, transcripts, and examples of the calls that compromised real companies. That is meaningfully more effective than generic phishing awareness. Hearing what a Scattered Spider vishing call actually sounds like produces a different kind of recognition than being told that attackers sometimes pretend to be from IT.
The insider dimension
One aspect of the Twitter 2020 hack received less attention than the social engineering angle. That was the possibility that some employees were directly bribed rather than simply deceived. Court documents and subsequent reporting suggested that at least one Twitter employee with internal access may have been deliberately recruited rather than manipulated. The investigation named a UK national who allegedly used his Twitter access to provide information about specific account holders.
This matters because it points to a different kind of insider threat. Social engineering typically focuses on making external attackers appear to be insiders. But sometimes the attacker IS an insider, or recruits one. An employee approached with a financial offer, a personal threat, or an appeal to ideology presents a different threat model than an employee deceived by a convincing pretext. The defenses are correspondingly different.
Access controls, privilege minimisation, and behavioural monitoring address the insider threat in ways that security awareness training cannot. The principle of least privilege means giving employees access only to what they need for their specific role. It limits the blast radius when any single insider, deceived or deliberate, is compromised.
What you should do
For individuals: the most important personal defense is a simple rule. Any request involving your credentials, a wire transfer, gift card purchase, or remote access to your device gets verified through an independent channel before you act. Not after. Before.
The urgency will feel real. The authority will feel real. The story will make sense. Act anyway — make the independent verification call, look up the number yourself, take the five minutes to confirm. If everything was legitimate, you’ve lost five minutes. If it wasn’t, you’ve stopped an attack that might otherwise have cost you thousands of pounds, thousands of dollars, or years of account recovery.
For the credentials and accounts that matter most, enable the strongest available multi-factor authentication and keep recovery contact information current. That means email, banking, and anything tied to your financial life. Understand that even 2FA can be bypassed. A well-timed social engineering call may ask you to read your authentication code to a “support representative.” Never do that. Your authentication code is not something you read to anyone, ever, for any reason.
The fundamental insight is simple. Social engineering works by exploiting the psychological mechanisms that make you a functional human being. It targets your respect for authority and your responsiveness to urgency. It targets your desire to be helpful and your sense of social obligation. These are not weaknesses you should try to eliminate. They’re traits that being socially engineered can exploit, but that understanding can protect. You don’t need to stop trusting people. You need a simple habit of verification that runs parallel to that trust, activated whenever the stakes are real.
Slow down. Verify. Call back on the number you found yourself. A legitimate caller will wait.
Your personal information — your name, home address, employer, phone number, and email address — is almost certainly listed on data broker sites right now. That’s the raw material that makes social engineering attacks convincing. See what a scan finds → walks through an example report of the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.