[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.1.a
AP Cybersecurity · Securing Spaces
Identifying Social Engineering Attacks
Every tactic borrows a feeling strong enough that the ordinary check feels unnecessary.
key ideaEvery tactic here is a way of borrowing a feeling so the target skips a check.
How the attack works
Social engineering does not attack a system. It attacks the decision a person makes about a system — and it does so by supplying an emotion strong enough that the ordinary check feels unnecessary or rude.
Pretexting sets the stage and the other tactics push on it. A single message often carries three or four at once, which is why they are easier to name after the fact than during.| Tactic | What the adversary does | Feeling borrowed | Typical wording |
|---|
| pretexting | invents a believable reason for contact | plausibility | “I'm from IT about your ticket” |
| authority | impersonates or relays from someone with power | deference | “The director asked me to…” |
| intimidation | states negative consequences if refused | fear | “Your account will be closed” |
| consensus | implies everyone else already complied | conformity | “The rest of your team has done this” |
| scarcity | claims limited availability | loss aversion | “Only three slots left” |
| familiarity | poses as someone close to the target | trust | “It's Dan from accounts, remember?” |
| urgency | sets a deadline to force quick action | haste | “Before 5 p.m. today” |
Read the third column. The tactics are interchangeable; the goal is always the same — produce a state in which the target acts before verifying.
| Pair that appears together | Why it works | The counter |
|---|
| authority + urgency | the boss, and there is no time to check | verify out of band — a known number |
| familiarity + intimidation | a friend in trouble, and it will get worse | ask for a shared secret |
| scarcity + consensus | limited, and everyone else already acted | slow down — scarcity is almost always invented |
| pretexting + anything | the story explains why this is happening now | question the premise, not just the request |
The counters are all the same move in different clothing: put a checkable step between the feeling and the action.
Indicators
Pretextingthe reason for contact
Authority, intimidation, urgencythe push
Consensus, scarcity, familiaritythe pull
what to notice
- An unexpected contact that explains itself unusually well — that explanation is the pretext.
- A deadline that exists only inside the message.
- An instruction that discourages verification: don't call, don't tell anyone, just do it.
- A request that would be routine except that it bypasses a normal process.
Worked analysis
EX 1
Name every tactic in one message
“This is Priya from the director's office. He needs the vendor list emailed before the 4 p.m. board call — everyone else has already sent theirs and I'd hate for your team to be the one holding it up.”
1
Find the pretext
‘from the director's office’ supplies a reason to be in contact.
2
Find the authority
The request is relayed from someone with power — and relayed, so the director is not available to confirm.
3
Find the urgency
4 p.m. is a deadline that exists only in the message.
4
Find the consensus and the intimidation
‘everyone else has sent theirs’ is consensus; ‘holding it up’ is mild intimidation.
5
Give the response
Call the director’s office on the number in the internal directory. The whole construction is designed to make that call feel unnecessary.
EX 2
Scarcity in a benefits scam
An email offers a limited-time hardship grant for employees, with 12 places left and a form asking for bank details.
1
Name the primary tactic
Scarcity — a countdown that manufactures pressure.
2
Ask whether the scarcity is checkable
There is no independent way to confirm twelve places. Invented scarcity always looks like this.
3
Look at what is requested
Bank details, on a form, outside the normal HR system.
4
Note the emotional target
Financial hardship — the message is aimed at people least able to lose money.
5
Give the response
Go to HR through the channel you already use. A real program exists there or does not exist.
EX 3
Familiarity without intimidation
A message says: “Hey, it's Marcus — we met at the conference in Leeds. Quick favor?” No threat, no deadline. Is this social engineering?
1
Identify the tactic
Familiarity — a claimed prior relationship establishing trust.
2
Note what is absent
No urgency, no fear. That is deliberate — pressure is what makes people suspicious.
3
Identify the strategy
This is the opening move. The ask comes after rapport is established.
4
Note why it is harder to spot
Slow attacks do not trip the pattern people are taught to look for.
5
Give the response
Verify the claimed connection independently before any request arrives. Familiarity is a claim, and claims can be checked.
Real incident
voice phishing · technology company · help-desk impersonation
Attackers called the help desk pretending to be employees, and were given access
Callers used pretexting and familiarity — correct names, correct manager, correct project — all collected from public profiles. They added urgency (‘locked out before a client demo’) and asked for a password reset. The help desk, trained to be helpful, complied.
Why it matters here: No technical control was defeated. The failure was a process that let helpfulness substitute for verification, which is why the fix was a scripted callback rather than a new tool.
Check yourself
What is pretexting, and how does it differ from the other tactics?
Show answer
It is a believable reason to be in contact at all. The others apply pressure; pretexting supplies the setting in which the pressure makes sense.
Distinguish authority from intimidation.
Show answer
Authority borrows someone's power — ‘the director asked’. Intimidation states negative consequences if the demand is refused. They often appear together.
Why is consensus effective even when nothing is threatened?
Show answer
It uses conformity: believing everyone else has already complied makes refusing feel like being the difficult one. No fear is required.
What single habit defeats most of these tactics?
Show answer
Verify through a channel you initiated — a number from the directory, the app you already use. Every tactic here works by making that step feel unnecessary.