Social Engineering: The Six Levers Attackers Pull on People
Every scam, whatever the channel, works by pulling the same few psychological levers. Learn to recognise authority, urgency, fear, helpfulness, curiosity and reward, and most attacks lose their grip.
Phishing emails, scam calls, fake invoices, WhatsApp fraud and deepfake video calls look different on the surface. Underneath, they are the same thing: an attempt to get a person to act before they think. Security people call it social engineering, and it works by pulling on a handful of very human instincts.
Learn to recognise the levers and you can spot a scam you have never seen before, in any channel and any language.
1. Authority
We are taught to do what senior people, officials and institutions ask. Attackers borrow that authority: an email from "the CEO", a call from "the bank's fraud team", a letter from "the tax office".
Ask: would this person really ask me this, this way? A real boss can wait five minutes while you check.
2. Urgency
"Today." "Within the hour." "Before your account is closed." Time pressure stops you checking, because checking feels like it will make you late. It is the most common lever of all.
Ask: why can this not wait for a quick phone call to confirm it?
3. Fear
Your account has been compromised. Your card has been used abroad. You will be fined. Fear narrows attention to one thing, making the problem go away, and the attacker is conveniently offering the solution.
Ask: if this were real, could I confirm it by contacting the organization myself?
4. Helpfulness
Most people want to help a colleague, a customer or someone in trouble. A caller who is "locked out and about to miss a deadline", or a stranger who "sent money to your number by mistake", is counting on your kindness.
Ask: am I being asked to bend a rule to help? That is exactly what an attacker would need.
5. Curiosity
A shared document called "Salary review 2026". A parcel you do not remember ordering. A photo "you have to see". Curiosity gets clicks that no amount of pressure could.
Ask: was I expecting this? If not, why is it being sent to me?
6. Reward
A prize, a refund, a bonus, an investment that cannot lose, a job offer that is almost too good. Greed is too harsh a word; hope is closer. Attackers offer something you would like to be true.
Ask: if it seems too good to be true, what would it cost me to check first?
The combination is the tell
Real messages sometimes use one of these levers. Scams usually pull several at once: an authority figure, an urgent deadline, a reason for secrecy and a request that bypasses the normal process. When you notice two or three levers in one message, that is your signal to slow down.
One habit beats them all: when a message asks you to act, confirm it through a channel you choose, such as a known phone number, the official app, or walking over to a colleague's desk, not through the channel the message came from.
Building the instinct
Knowing the levers in theory is a start; recognising them under pressure takes practice. CyberWatch AI's realistic simulations use these same pressures in a safe setting, short training lessons explain what people missed, and every employee can check and report a suspicious message in one step.
