The Six Psychological Levers Every Social Engineer Pulls

Your phone rings at 4.40 on a Friday afternoon. The caller says they are from the bank's fraud team, or IT, or they sound exactly like your director. The request itself is ordinary: confirm a transfer, approve a sign-in, send over a document. What is not ordinary is the pressure around it. It has to happen now. It comes from someone senior. Something bad will follow if you delay. And it would be better not to mention it to anyone yet.

You decide in under a minute. When this kind of attack succeeds, it is usually because the target was responding to a social situation, not failing to spot a technical exploit. Social engineering uses psychological and social manipulation to influence a target's actions. That does not make the people who fall for it careless. It means the attacker has designed the moment so that the normal, helpful response is the wrong one.

Last checked: 28 September 2026.

#What Psychological Tricks Do Social Engineers Use?

Social engineers commonly apply six pressures: authority (the request appears to come from someone you should obey), urgency and scarcity (there is no time to check), fear (something bad will happen if you do not act), familiarity and liking (the request comes from someone who seems known or friendly), commitment and consistency (you have already agreed to part of it), and secrecy (you are told to keep it to yourself). They are often combined. The useful skill is not memorising the names. It is noticing the pressure while it is happening and slowing the decision down long enough to verify the request through a channel you already trust.

#Where the Six Levers Come From

Psychology does not define an official list of six social-engineering levers. Several overlapping models exist. Robert Cialdini's principles of influence name reciprocity, scarcity, authority, consistency, liking, social proof and, since 2016, unity. Stajano and Wilson's study of scams (Communications of the ACM, 2011) proposed seven principles, including distraction, social compliance, herd behaviour and time pressure. Ferreira, Coventry and Lenzini (2015) merged these into five and noted that other principles may not yet be identified.

This article uses a practical six-lever framework built from those models and from what the evidence says matters in phishing and fraud:

• In a study of 158 people who each received 21 simulated phishing emails, scarcity and authority were the most effective principles and social proof and commitment the least (Lin et al., ACM TOCHI, 2019).
• Analysing 1,281 unique phishing emails reported at a large European bank, researchers found that consistency and scarcity clearly increased clicks, while social proof and liking showed no clear effect (van der Heijden and Allodi, USENIX Security 2019).
• Ferreira and colleagues found liking and similarity the most common principle in their sample of 52 phishing emails.
• The FBI's current warnings add fear and secrecy explicitly: scammers "rely on fear, urgency" and urge victims "not to tell family, friends, financial institutions, or law enforcement" (IC3, July 2026; IC3, September 2026).

These studies used specific samples and settings, so treat their rankings as indications, not laws of behaviour. The six levers below are a defensive tool for recognising pressure, not a scientific taxonomy.

#1. Authority

People are more likely to comply when a request appears to come from someone with legitimate authority: a CEO or CFO, an IT administrator, a lawyer, a bank, a regulator, the police, platform support. Questioning a senior person feels risky, so the request gets less scrutiny than it deserves. Authority can make a request appear legitimate without proving who sent it.

Malaysian examples are easy to find. MyCERT's May 2026 boss impersonation alert describes emails to executives that exploit "authority, trust, and a sense of urgency". CyberSecurity Malaysia's Q2 2026 incident summary describes callers impersonating the police, LHDN, MCMC and banks to pressure people into revealing information.

Ask: would I do this if the person were not claiming that authority? Then verify the identity through a channel you already know, such as the directory number, never the number or link supplied in the request. The FBI's advice for official-sounding callers is the same: use publicly available contact details, "not contact information provided by the person contacting you".

#2. Urgency and Scarcity

Urgency compresses decision time. The account closes today, the payment must go out in five minutes, the security incident is happening now. Scarcity is the same pressure framed as loss: a one-time approval, an expiring link, an offer that will not come back. They overlap so heavily that this framework treats them as one lever.

Research on real phishing victims found that urgency cues draw attention onto the demand itself, leaving less attention for the details that might reveal the deception (Vishwanath et al., 2011). The point of the deadline is to remove the pause in which you would have checked.

Slow the decision down. Ask what actually happens if you wait ten minutes and verify. A genuine deadline survives a short check, and an organisation with a real urgent process has a verification step built into it. High-risk requests should trigger a verification procedure, not faster compliance.

#3. Fear and Threat

Fear makes immediate action feel safer than checking. Common threats include account suspension, arrest or legal action, financial loss, a security breach, trouble at work, or a family emergency. The attacker creates the threat and then offers the way out: pay, click, approve, confirm.

The FBI's September 2026 warning on law enforcement impersonation describes callers who threaten "arrest, prosecution, or imprisonment" and use "urgent and aggressive tones". Its July 2026 alert tells people to be wary of anything that provokes "anger, fear, disbelief" and to take a moment to verify.

Fear is a reason to verify, not a reason to bypass the normal process.

Never act through the channel that delivered the warning. Open the bank app, the platform or the company directory yourself.

#4. Familiarity and Liking

People trust what feels familiar. Attackers borrow familiarity through names, profile photos, details from earlier conversations, company terminology, real supplier names, spoofed phone numbers, copied email signatures and, increasingly, AI-generated voices. Liking works alongside it: a friendly contact who has been helpful for weeks is easier to say yes to.

Caller ID can be faked; CISA notes that internet calling "easily allows caller identity (ID) to be spoofed". The FBI warns that criminals use short audio clips of a loved one's voice to fake a crisis, and that cloned voices "can sound nearly identical" to the real person. Our article on AI voice cloning attacks explains how little audio that takes.

Familiarity is not authentication.

A known voice, name or profile tells you who someone appears to be, not who they are. Authenticate through a second signal: a callback to a known number, a question only the real person could answer, or a family code word, which the FBI recommends.

#5. Commitment and Consistency

Once people have agreed to something, they tend to stay consistent with it. An attacker may start with a harmless request, such as confirming a name or opening a document, then build on it: "you already confirmed this last week", "you approved the first part". Each step feels like a continuation rather than a new decision. The European bank study found consistency had a clear positive effect on clicks.

Treat each high-risk request as a new decision. Prior agreement is checkable in a system, a ticket or an email thread, not in the conversation. If someone says you already approved it, look it up yourself.

#6. Secrecy and Isolation

Attackers often ask targets not to tell colleagues, finance, IT, managers, the bank or family. The FBI describes scammers "refusing to speak to or leave messages with anyone other than the targeted victim, keeping victims on the phone" and urging them not to tell anyone. Secrecy removes the second opinion that would stop the attack.

A request that demands secrecy deserves more verification, not less.

Bring someone in: a second approver, a trusted colleague, the security team, a known family contact, or your established escalation route. Genuine confidential work still has approved channels; a real acquisition does not require you to bypass payment approval.

#Reciprocity and Social Proof: Real, but Weaker in the Evidence

Two classic principles did not make the six. Reciprocity is the pull to return a favour: someone helps first, or offers a gift, then asks for something back. Social proof is following the crowd: "everyone on your team has already done this". Both appear in attacks, and help desks, which are measured on helpfulness, can be especially exposed to reciprocity. But in the phishing studies above, social proof was consistently among the least effective principles, and reciprocity's effect was mixed, stronger for older adults in one study and slightly negative in the bank data. Recognise them; do not expect them to be the main pressure.

#When Multiple Levers Appear Together

A convincing attempt rarely relies on one pressure. A caller claiming to be your director (authority) needs something done right now (urgency), asks you not to loop anyone else in (secrecy), and hints that delay could become a serious problem (fear). Each lever makes the others harder to resist, because questioning any one of them means challenging all of them at once.

That stacking is itself a warning sign. The more levers you notice in one request, the stronger the case for stopping to verify.

#The Six-Lever Recognition Test

#The Core Defence: Notice, Pause, Verify, Escalate

You do not need to detect the scam perfectly. You need to notice the pressure being applied and slow the decision down.

1. Notice: name the pressure. Authority? Urgency? Secrecy?
2. Pause: refuse the attacker's timetable. A short delay costs a genuine request very little.
3. Verify: use an independently known channel, never contact details supplied in the request.
4. Escalate: bring in another trusted person whenever the request has real consequences.

#Why Intelligent People Still Fall for Social Engineering

Victims include experienced, technically skilled and security-conscious people. An attack can still work when the timing is bad, the person is busy, the request matches their normal job, the attacker has inside context, the organisation rewards speed, the person fears getting it wrong in front of a superior, or the request appears to come from authority. Intelligence and competence do not switch off these pressures. Blaming victims also has a cost: people who expect blame hide mistakes, and hidden mistakes become breaches.

#Why "Just Be More Careful" Is Not a Security Control

Vague advice asks for judgement at exactly the moment the attacker is working to remove it. Specific rules do not.

#Build Verification Into the Workflow

Independent verification is a process control that can reduce the risk of impersonation-based fraud. Useful controls:

• Callback verification using a known-contact directory.
• Dual approval and separation of duties for payments.
• Established supplier records for any bank-detail change.
• Documented identity checks at the help desk.
• Written confirmation through an official channel.
• Clear escalation procedures.
• Phishing-resistant authentication, such as passkeys or security keys, where available.

The goal is not to make people perfectly sceptical. It is to make unsafe actions difficult and safe actions normal. Our article on why social engineering beats your security stack covers these controls in more depth.

#What Employees Should Do When They Feel the Pressure

1. Stop: pause before replying, clicking or approving.
2. Name it: which lever is being pulled?
3. Verify: use a channel you already know.
4. Escalate: ask a colleague, manager or the security team.
5. Report: document the attempt, even if you did nothing wrong, or even if you did.

#What Finance Teams Should Do

• Verify urgent transfers by calling back on a directory number.
• Require a second approver for payments outside the normal cycle.
• Change supplier bank details only through the established vendor-record process.
• Check unusual invoices against purchase orders and existing records.
• Never approve a payment on the strength of a voice or an email alone.
• Send confidential financial information only through approved systems.

In July and August 2026, Malaysian police reported companies in Ipoh and Kuala Terengganu losing hundreds of thousands of ringgit after staff followed payment instructions from someone posing as their boss on WhatsApp. An independent callback is designed for exactly that moment.

#What IT and Help-Desk Teams Should Do

• Verify identity before any password or MFA reset, using a documented method.
• Apply stricter checks for privileged accounts and new device enrolment.
• Call the employee back on the directory number rather than trusting the incoming call.
• Escalate requests that cannot be verified.
• Make no exceptions because someone claims urgency or seniority.
• Remove performance metrics that punish the extra verification step.

#What Executives Should Do

• Follow the same verification controls as everyone else, visibly.
• Never ask staff to bypass procedures, even informally.
• Do not use status to override controls.
• Thank people who verify you.
• Encourage immediate reporting, including of your own near misses.
• Take part in simulations.

If the CEO routinely says "just do it", staff learn that controls are optional, and an attacker imitating the CEO inherits that permission.

#What Creators and Public-Facing People Should Do

Public-facing people are exposed to familiarity and authority in both directions: attackers impersonate brands and platforms to reach them, and impersonate them to reach their audience.

• Verify sponsors and managers through the brand's official channels.
• Remember that platforms do not ask for passwords or codes by message; our guide to the fake Meta support scam shows what these look like.
• Protect your account recovery email and phone.
• Keep a record of known business contacts.
• Never disclose authentication codes.
• Watch for impersonation accounts; our impersonation evidence guide explains what to save.
• Agree a verification step with family and team for urgent requests, since your voice may be publicly available.

Our digital identity protection work covers the account and identity side.

#How AI Makes the Six Levers More Convincing

AI improves personalisation, language quality, translation, voice imitation, visual impersonation, volume and response speed. The FBI has warned of AI-generated voice messages impersonating senior officials (May 2025) and of scammers appearing as officials on video calls. That strengthens authority and familiarity in particular.

It does not make social engineering unstoppable. It makes the authenticity signals people used to rely on, such as a familiar voice, good grammar or a real-looking face, less trustworthy. Verification through an independent channel still works, because it does not depend on judging how real something sounds. Our guide to verifying a suspicious video call covers the deepfake case.

#Can Security Awareness Training Stop These Attacks?

Training helps, but awareness alone is not enough. Knowing that voice cloning exists does not guarantee that someone will call back their director while he sounds annoyed on the phone. Training works best alongside workflow controls, independent verification, clear escalation, strong authentication, least privilege, role-specific scenarios, realistic simulations, immediate coaching and measurement. We make the longer case in why security awareness training is broken.

#How to Test the Human Layer Safely

Authorised testing can show how people and processes respond to phishing, vishing, SMS, callback, help-desk and deepfake scenarios. It must be authorised in writing, scoped, documented, safe and proportionate. The objective is to find process weaknesses, unclear ownership, escalation and verification failures, and reporting delays, not to embarrass individuals.

#How AwareXone Tests the Human Layer

AwareXone runs authorised social-engineering testing and training: written-scope simulations across email, voice, SMS, callback and deepfake scenarios, followed by coaching and workshops. Depending on the engagement, that can include spear phishing, vishing, smishing, callback phishing, help-desk pretexts and authorised voice-cloning or deepfake video call scenarios.

Every engagement runs on written authorisation, a defined scope, agreed scenarios and an emergency stop contact, and reports do not name individuals. The sequence is test, observe, coach, improve. Simulations show how an organisation responds to the scenarios tested; they do not predict every real attack, and we do not promise a particular result. You can read how we work.

#The 60-Second Social Engineering Check

• Is someone using authority to pressure me?
• Am I being rushed, or told the chance will disappear?
• Is fear being used?
• Am I trusting familiarity instead of verification?
• Am I being told I already agreed to this?
• Am I being asked to keep this secret?

If any answer is yes: stop, verify, escalate.

#Social-Engineering Resilience Checklist for Businesses

• High-risk requests require independent verification.
• Payment changes require a second approval.
• Help-desk identity verification is documented.
• Employees know where to report suspicious requests.
• Executives follow the same controls.
• MFA is enabled.
• Sensitive recovery processes are protected.
• Staff receive role-specific training.
• Simulations are authorised and scoped.
• Incidents produce lessons and process changes.

#Frequently Asked Questions