Spotting Social Pressure in Digital Scams

One of the most effective ways attackers persuade people is by pretending to be someone they’re not. Criminals may pose as new employees, service providers, or researchers and may provide fabricated credentials to appear legitimate.

More sophisticated scenarios—like Business Email Compromise (BEC)—involve messages that appear to come from a trusted colleague, supervisor, or executive. An attacker may ask a staff member to complete a task quickly, such as making an unexpected purchase or sharing information.

Attackers may also pretend to be IT or helpdesk staff, attempting to convince someone to disclose login information or to install software granting remote access.

Before these messages are sent, attackers often spend time combing publicly available sources—including university websites or news—so they can tailor messages to a specific individual or role. This careful preparation helps their requests feel more believable.

Social engineering works best when it feels like there’s no time to think. Criminals manufacture urgency so that recipients react quickly without pausing to assess the situation.

These messages often involve unusual or unexpected requests. One common example in BEC scams includes an urgent request to buy gift cards, sometimes framed as a reward for team members. The explanation usually suggests that the sender is unable to make the purchase themselves.

Attackers also take advantage of high-stress situations—such as public health crises, economic uncertainty, or holidays—when people may be more distracted. Messages sent during these times are designed to feel timely and important, making it more likely that the recipient will respond without verifying the request.

Phishing isn’t limited to email inboxes. These scams can appear through text messages (smishing) or voice calls (vishing), further blurring the line between legitimate and harmful communication.

In vishing, attackers use phone calls to gain trust. Because many people naturally assume that a voice on the phone is genuine, criminals take advantage of this medium. Some even use phone technology to spoof phone numbers so that the call appears to come from a trusted source.

Attackers posing as helpdesk staff may request login details over the phone or through SMS, attempting to gain access to systems or personal accounts.

Multi-Factor Authentication (MFA) offers an important layer of protection by requiring a second approval step when logging in. However, attackers have learned to exploit this system by sending repeated authentication prompts—a technique known as ‘MFA fatigue’ or ‘push bombing’.

The goal is to wear down the targeted person. After receiving many notifications, an employee may press “Accept” simply to stop the constant interruptions, accidentally giving the attacker access.

This technique highlights how social pressure doesn’t always look like urgency or authority—it can also be persistent annoyance.