Human factors and phishing

Social engineering is the manipulation of people rather than systems to gain unauthorised access, extract information, or trigger an action. Each attack type uses a different channel or targeting approach.

Phishing uses deceptive email campaigns sent to large numbers of recipients hoping a percentage will respond. The Toyota Boshoku attack was a targeted form called spear-phishing, where the attacker tailored the message to a specific individual using researched context (their role, their supplier relationships, the urgency of payment processing). Whaling is spear-phishing targeted at senior executives (CEOs, CFOs) who have authority to authorise large transfers or access sensitive systems.

Vishing (voice phishing) uses phone calls, often with spoofed caller ID, to impersonate authority figures such as bank fraud teams, IT support, or government agencies. The Twitter 2020 breach (Module 6) used vishing: attackers called Twitter support staff impersonating IT colleagues. Smishing uses SMS text messages with malicious links or fraudulent instructions.

Pretexting involves constructing a fabricated scenario (a pretext) to gain trust. An attacker who calls a company reception claiming to be a new IT contractor needing building access is using pretexting. Many sophisticated attacks combine multiple techniques: a smishing message creates urgency, a follow-up vishing call confirms it, and the target complies with a fraudulent request.

Social engineering attacks are effective because they exploit psychological patterns that are not vulnerabilities in the usual sense: they are features of normal human social behaviour. Robert Cialdini's six principles of influence, documented in his 1984 book "Influence: The Psychology of Persuasion," provide a structured vocabulary for understanding why.

1. Authority: people follow instructions from perceived authority figures. An email appearing to come from the CEO requesting an urgent fund transfer exploits authority.
2. Urgency and scarcity: artificial time pressure prevents careful verification. "This must be processed today or the contract is lost."
3. Social proof: people follow what others appear to be doing. "Everyone in your department has already completed this security update."
4. Liking: people comply more readily with those they like or identify with. Attackers research social media to find shared interests, mutual connections, and familiar names.
5. Reciprocity: people feel obligated to return favours. A helpdesk attacker who offers to help a user with a problem first may then ask for something in return.
6. Commitment and consistency: once someone has agreed to a small request, they are more likely to agree to a larger one. "You said you wanted to keep your account secure? Then I just need you to verify this code."

Social engineering works on cognitive biases that are well established and that training does not remove. The defences that hold combine technical controls, which make the wrong action harder to take, with procedural ones, which make verification easy enough that a busy person still does it.

For years, awareness training taught people to spot phishing by its tells: clumsy spelling, broken grammar, a greeting addressed to your email address instead of your name. That advice no longer protects anyone. A lure written by a large language model reads as fluently as a genuine message, and generated voice and video now defeat the older instinct that asks whether something looks real.

In January 2024 an employee in the Hong Kong office of the engineering firm Arup joined a video call to discuss a confidential transaction. The chief financial officer was on the call, and so were several colleagues the employee recognised. Every one of them was a deepfake. Reassured by faces and voices that matched people they knew, the employee authorised fifteen transfers worth about 25.6 million US dollars before the fraud came to light. It was a business email compromise in everything but the channel: the same executive-authority pressure that once arrived by email now arrived as a live meeting nobody thought to doubt.

The lesson is not that the employee was careless. It is that the detection task they had been set was now impossible. Any control that depends on a person noticing that a message, a voice or a face is fake is a broken control, because the fakes are good enough to pass. Detection has to move to something the attacker cannot forge: a procedure that checks the request through a separate, trusted channel, however convincing the request itself appears.

If people can no longer be asked to detect fakery, the defence has to sit in the procedure rather than in the individual’s judgement. A good verification procedure shares one property: following it is easier than breaking it, so the safe path is also the path of least resistance.

Out-of-band verificationis the core move. When a request arrives to move money or to change standing data such as a supplier’s bank details, the person acting on it confirms the request through a separate channel that the requester did not choose. In practice that means a callback on a number already held in the directory, never a number supplied in the message or read out on the call. The Arup transfers would have failed this single test: a call to the real chief financial officer, on the number the finance team already held, would have reached a person who had authorised nothing.

Two further controls harden the procedure. Dual authorisation requires a second named person to approve any payment or standing-data change above a set threshold, so no single deception is enough. Pre-agreed code phrases give executives and their finance teams a shared secret that a synthetic voice cannot produce on demand. None of these steps asks anyone to judge whether a face or a voice is genuine. They replace that impossible judgement with an action a convincing fake cannot complete: reaching the real person, winning a second approver, or repeating a phrase it was never told.

When a programme fails, the reflex is to say that users are the weakest link. The NCSC rejects that framing. Its human-centred security guidance holds that people fail because systems are designed badly: security tasks that are confusing, slow, or impossible to complete correctly set people up to make the mistake, and a blame culture then punishes them for it. Blame carries a measurable cost, because staff who fear punishment stop reporting, and reporting is the earliest signal an organisation has that an attack is under way.

This changes what an awareness programme should measure. A simulated phishing click rate looks like a number that means something, but on its own it rewards fear and secrecy: the way to drive it down is to make staff afraid to click anything and afraid to admit when they do. The metrics that matter track behaviour instead. How many people reported the simulated message, and how quickly? When a real suspicious email arrives, how long is it between the first sighting and the security team knowing? Is the reporting rate rising as people learn that reporting is welcomed rather than penalised?

Building that culture is deliberate work. Leaders report their own near misses openly, so that reporting looks normal rather than shameful. Honest mistakes are handled without punishment, so the person who clicked is treated as the source of a useful signal rather than as a failure. Reporting a suspicious message is made a single, obvious action, not a trip through a helpdesk queue. Measured this way, a programme is judged by whether behaviour changes and whether the organisation hears about trouble sooner, not by whether a click-rate chart trends down.