0.3The human factor & social engineering
The essentials in 30 seconds
- The attacker targets the human, not the machine: social engineering gets politely asked for what technical hacking cannot obtain.
- Urgency, authority, trust: three universal levers that short-circuit thinking — all the more effective with real information (OSINT).
- The universal safeguard: urgent + unusual request = verification through another channel before acting.
Threaded mini-case — Karim steps into the attacker's shoes
Karim, an office employee in Algiers, searches for himself on a search engine and LinkedIn: his position, his colleagues, an ongoing project with a real supplier — everything is there. He pictures the perfect email an attacker could send HIM: the project name, the supplier's tone, end-of-day urgency. The lever that would work on him? The desire to help, fast. He decides his safeguard: every urgent and unusual request will be verified through another channel, with no exception.
Standalone case for this section: it returns in the lesson, the diagram, the script and the 48h challenge of section 0.3.
1. Manipulate rather than hack
Social engineering is the art of manipulating people to get what you want, with no technical hacking. An attacker mastering this lever does not need to break a password: they politely ask you for it, posing as someone else. Karim understood it by picturing the perfect attack against himself: with his public information, anyone can build a credible pretext (pretexting) — a scenario sewn with real information (website, LinkedIn, out-of-office message) to lull suspicion.
2. The levers exploited
The psychological levers: urgency (“you must answer right now”), authority (“the director is asking”), trust (“I am your new colleague”), fear (“your account will be blocked in 1 hour”), the desire to help. The more personalised an attack is (real information via OSINT — public information from social networks, sites and directories), the more effective it is. Karim's fake supplier cited a real project: that is what makes the trap formidable.
3. Knowing you can be manipulated
Urgency + unusual request = the two signals that must trigger verification. Knowing you can be manipulated is not a weakness: it is the condition of vigilance. Penetration tests show everyone clicks one day — the right question is not “am I infallible?” but “what happens when I get it wrong?” (two-factor authentication, reporting, backups: the safety nets of the following levels). Karim's safeguard fits in one sentence and does not depend on his mood of the day.
🔎 Concrete example — 🔎 Concrete example — Think like an attacker (ethically)
Search for yourself on a search engine + LinkedIn: what does a stranger find?
What credible email could be sent to YOU (real project cited)?
Which lever would work: urgency? authority? desire to help?Takeaway: Karim finds his position, his colleagues and a real project: the pretext is all ready.
Lesson: “urgent + unusual request = verification through another channel”.
Section vocabulary
- Social engineering
- The art of manipulating to make people act: the attacker does not attack the machine, they convince the human.
Simple example: Karim receives a call from a “technician” asking for his password for urgent maintenance.
What it is not: a virus installing itself with no human intervention.
Reflex: faced with any request, ask “who is asking me, and through which channel can I verify?”.
- Urgency lever
- “It is urgent, do it now”: short-circuiting thinking — the No. 1 lever of fraud.
Simple example: Karim receives “your account will be blocked in 1 hour, click here”: urgency aims to prevent verification.
What it is not: a real deadline announced in advance through a verifiable official channel.
Reflex: the more urgent it is, the more I take 5 minutes to verify.
- Authority lever
- Posing as a manager, the bank, an official service: you obey before verifying.
Simple example: Karim receives a message signed “management” demanding an immediate confidential transfer.
What it is not: an ordinary, non-urgent request sent through the usual channel.
Reflex: verify any unusual “from above” instruction through another channel.
- Pretext (pretexting)
- A credible scenario built with real information (website, LinkedIn, out-of-office) to lull suspicion.
Simple example: Karim's fake supplier cites the real ongoing project and the name of a real colleague on leave.
What it is not: a generic message with no real detail (“dear customer”, crude mistakes).
Reflex: true details do not prove identity: verify anyway.
- OSINT
- Public information (social networks, website, directories) the attacker collects to personalise the attack.
Simple example: Karim limits what he exposes: precise title, org chart and absences are no longer publicly accessible.
What it is not: hacked data stolen from company systems.
Reflex: look at yourself through an attacker's eyes once a year.
In practice — In practice — Think like an attacker (ethical exercise)
- Search for yourself on a search engine + LinkedIn: what does a stranger find about your position, colleagues, projects?
- Picture the scenario: with this information, what credible email could be sent to YOU? (e.g. fake supplier citing a real project).
- Identify the lever that would work best on you: urgency? authority? desire to help?
- Decide a personal safeguard: “every urgent + unusual request = verification through another channel”.
Ready-to-say script — answer an urgent and unusual request
“I understand the urgency, but our procedure requires me to verify: I will call you back in 5 minutes on the official number I have in the directory, and we will unblock this together.”
Say it calmly, without accusing; verification through another channel is not distrust, it is procedure.
Copy-paste template — my personal safeguard
MY RULE (1 sentence): if a request is urgent OR unusual OR confidential → I verify through another channel before acting.
MY VERIFICATION CHANNELS (directory, official numbers): _______________
MY WEAK LEVER (urgency? authority? desire to help?): _______________
MY REPORT BUTTON (messaging / IT): _______________VSE / tight budget
With no written procedure: the one-sentence rule displayed near the phone — “urgent + unusual = call back on the known number” — already protects the whole team.
SME in Algeria
Karim agrees with his manager in Algiers on a simple code word: any unusual instruction “from above” is confirmed by calling the known internal number, with nobody taking offense.
Reception / switchboard
First line exposed to calls: list of common pretexts displayed (fake technician, fake courier, fake director) with the conduct to follow for each.
Active social networks
Rich public profile: reduce professional exposure (precise role, org chart, absences) and check every month what a stranger can see.
✓ Best practices
- Treat urgency + unusual request as a verification signal.
- Limit public professional exposure to what is necessary.
- Prepare a safeguard: verify through another channel before acting.
✗ Common pitfalls
- Believing you are “too cautious to click” (everyone gets it wrong one day).
- Taking known personal details as proof of identity.
- Giving in to urgency pressure without verifying.
Key takeaways
- The attacker exploits universal human levers: urgency, authority, trust, desire to help.
- The more personalised an attack is (real information, real context), the more effective it is — and OSINT feeds it.
- Urgency + unusual request = the two signals that must trigger verification.
- Knowing you can be manipulated is not a weakness: it is the condition of vigilance.
48h Challenge - apply tomorrow
Do the exercise like Karim: search for yourself online, picture the perfect email that could be sent to you, identify your weak lever and write your one-sentence safeguard. Also spot your mailbox report button.
- I cite the 4 levers (urgency, authority, trust, fear) with one example.
- I know my vulnerability profile and my weak lever.
- My “urgent + unusual = verification” safeguard is written and known.
Frequently asked questions
I am cautious by nature, am I really vulnerable?
Penetration tests show everyone clicks one day — including experts, faced with a well-personalised attack on a tiring day. The right question is not “am I infallible?” but “what happens when I get it wrong?”. That is the role of the safety nets installed in the following levels: two-factor authentication (the stolen password is no longer enough), fast reporting (IT isolates before spreading), backups (encryption no longer blocks activity). Like Karim, accept your vulnerability: it is what makes the systematic safeguard — and the safeguard, not pride, protects you.
Should I lock down all my social networks?
Not necessarily everything, but think like an attacker: precise role + org chart + announced absences = material for targeted fraud. An out-of-office message saying “I am on leave until the 20th, contact Salima for project X” alone offers a complete pretext. Limit exposed professional information to what is necessary: vague titles in public, details in private, absences with no replacement name or project. Do the exercise once a year: look at your profile through the eyes of a malicious stranger, and remove what would serve a pretext.
Which two signals must trigger verification?