Social engineering and pressure tactics

Hacking people, not computers

Breaking into a well-protected system is hard. Persuading a person to open the door is often much easier. That is social engineering: using ordinary human instincts — politeness, helpfulness, respect for authority, fear of loss — to get someone to do something against their own interests. Europe's cybersecurity agency ENISA and national agencies treat it as one of the most common starting points for attacks on both individuals and organisations.

The good news is that the techniques are limited and repetitive. Once you can name them, they lose much of their force.

The levers fraudsters pull

Authority

"This is the fraud department." "I am calling from the police." "Our compliance team requires this." People tend to follow instructions from those who seem to hold authority. Counter: authority has to be checked, not assumed. Call back through a number you found yourself.

Urgency

"Your account will be closed in one hour." "The transfer must happen today." Time pressure stops careful thinking. Counter: treat urgency as a reason to slow down. Genuine problems can wait for a phone call to an official number.

Scarcity

"Only 50 places left." "This offer is invite-only." Things that seem rare feel more valuable. Counter: ask why something good would need to be rushed or hidden.

Fake proof

Screenshots of gains, rows of glowing reviews, comments saying "it worked for me", a group chat full of happy members. People look to others when unsure. Counter: anything shown to you by the person asking for money can be manufactured. Look for independent, official sources instead.

Friendliness and favours

A helpful stranger, a charming new friend, someone who "already did you a favour". People feel obliged to repay kindness. Counter: notice when friendliness arrives together with a request involving money, codes or apps.

Fear

Threats of arrest, fines, account closure, or exposure of embarrassing information. Fear narrows attention to escaping the threat. Counter: real authorities do not demand instant payment over the phone, and nobody can make you act in the next five minutes.

Secrecy and isolation

"Do not tell your bank, they will block it." "This is confidential." Secrecy cuts you off from the people who would spot the problem. Counter: any request to keep something from your bank or family is a strong warning sign on its own.

Small steps

A tiny first request — reply to a message, install an app, send a small amount — followed by larger ones. Once people have started, they tend to continue, especially after money has been spent. Counter: ask whether you would have agreed to the whole thing if it had been described at the start.

New tools, old tricks

AI tools make it easier to produce convincing messages without spelling mistakes, to clone a familiar voice from a short recording, and to create faces for fake profiles. The tools are new, but the levers are the same. A panicked call from a relative's voice asking for an urgent transfer is still urgency, fear and secrecy. Some families agree on a private code word to use in a genuine emergency.

Why it works on everyone

These levers work because they are useful in everyday life. Following a doctor's instructions, reacting quickly to a real emergency and trusting friendly neighbours are sensible habits. Social engineering hijacks them at the moments we are least likely to notice: when we are busy, tired, worried or flattered. Knowing the levers does not make anyone immune, but it does make it more likely that a small voice says "wait, this is urgency" at the right moment.

Phrases that give you time

It can feel rude to stop a conversation. Having a few ready-made sentences helps:

• "I never make decisions about money on the phone. I will call you back."
• "I need to talk to my family first."
• "Send that to me in writing and I will check it with your organisation directly."
• "I do not share codes with anyone. Goodbye."

A genuine caller will accept any of these. A fraudster will push harder, which tells you what you need to know.

Building a pause into your habits

1. The five-minute rule. For any request involving money, codes, apps or secrets, wait at least five minutes before acting. Pressure usually fades.
2. The second channel. Check through a contact route you found yourself, never the one offered in the message.
3. The second person. Describe the situation to someone you trust. If you feel you cannot, ask yourself why.
4. The written rule. Decide in advance that you will never share a recovery phrase or a login code, so there is nothing to decide under pressure.

This guide is general safety education. It is not financial, legal or security advice for your individual situation, and it does not recommend acquiring, holding or disposing of any crypto-asset. If you think you are dealing with fraud, contact your bank and the police.