---
title: "Why Social Engineering Works: Psychology and Practical Defenses"
description: Explore the psychological drivers behind social engineering attacks and practical ways to counter urgency, false authority, social proof, and MFA fatigue.
image: https://blog.ise.io/hubfs/Canva%20images/Canva%20Design%20DAHWfROvuOQ.png
---

[![vast.png](https://blog.ise.io/hs-fs/hubfs/Brand%20Images/Logos/logo.png?width=300&height=130&name=logo.png "vast.png")](https://www.ise.io/)

- [About](https://www.ise.io/about/values/)
- [Services](https://www.ise.io/services/vulnerability-assessments/)
- [Research](https://www.ise.io/research/)

[![Ask An Expert](https://no-cache.hubspot.com/cta/default/7197110/a5e42f88-f4cb-406c-83d7-a6e50c1e0d04.png)](https://cta-redirect.hubspot.com/cta/redirect/7197110/a5e42f88-f4cb-406c-83d7-a6e50c1e0d04)

# [Why Social Engineering Works: Psychology and Practical Defenses](https://blog.ise.io/blog/why-social-engineering-works-psychology-and-practical-defenses)

 Oct 5, 2026, 12:00:00 AM / by [Dr. Rachael Tubbs](https://blog.ise.io/blog/author/dr-rachael-tubbs)

As of September 2026, social engineering attacks are the single most common primary attack vector for initial access for cybercrime in the United States. Attackers default to social engineering because they follow the path of least resistance. Social engineering is the easiest path because over the past 10 years, organizations have poured the majority of their security budgets into technical defenses such as vulnerability management, patching programs, and bug bounty programs. These investments successfully raised the cost of developing novel code-based exploits, effectively causing attackers to rotate out of code-based exploits to social engineering attacks.

Social engineering attacks make up approximately [60%](https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf) of all confirmed enterprise data breaches, and over [85%](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) of total financial losses from cybercrime attacks can be traced back to social engineering-based tactics. At such high percentages, it is unsurprising that social engineering accounted for over [$20.8 billion losses](https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions#:~:text=IC3%20receives%20nearly%203%2C000%20complaints%20per%20day.,complaint%20at%20ic3.gov%20as%20soon%20as%20possible.) in the U.S. in 2025, up 37% from 2024. Unfortunately, this number could increase as the years go on. That leaves us to wonder, why is this happening? With countless resources now available, how does social engineering still work, despite how poorly executed and goofy so many of these attempts are? This can also lead us to wonder, why are so many of these attempts so bad? Well, [this is intentional](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/WhyFromNigeria.pdf). Scammers do this so that they get the best return on investment and have fewer false positives.

This blog will look at a few key psychological drivers that assist malicious attackers. You’ll learn how threat actors are exploiting basic human functioning, maybe without even realizing it. It will also provide you a short list to help you and your teams combat these psychological components. To begin, we will look at a few of the psychological drivers

## Key Psychological Drivers

Human decision-making operates through [two systems](https://dn790002.ca.archive.org/0/items/DanielKahnemanThinkingFastAndSlow/Daniel%20Kahneman-Thinking%2C%20Fast%20and%20Slow%20%20.pdf). This is known as [Dual Process Theory](https://pmc.ncbi.nlm.nih.gov/articles/PMC8979207/). We won’t go too deep into it here, but think of the first system as fast, automatic, and emotional. The second system is slow, analytical, and deliberate. We rely on these systems for different things every day, from choosing what to have for dinner to deciding if you should take that new job that requires you to move to a different state. Choosing burgers versus hot dogs for dinner likely does not require intense analytical thought, but choosing to move across the country for a job that may or may not pan out most likely requires some time to sit and evaluate.

Social engineering forces targets into the System 1 thinking. Attackers do this in a few ways, but the most popular is probably induced urgency. Scammers like to establish artificial deadlines to cause high stress and time pressure to impair executive function in the prefrontal cortex. When artificial time constraints are enacted, it creates a sense of fear and urgency, which prevents people from pausing and thinking through the situation in a rational manner.

Another common tactic is exploiting cognitive biases. Attackers use predictable mental shortcuts to shape decisions and persuade victims to share personal information, which is where the principles of social influence become especially relevant. In all, there are six principles of influence, and some are more commonly used than others in a social engineering attack. Authority, reciprocity, and social proof are the three that we will focus on here.

![Screenshot 2026-09-22 at 10.57.10 AM](https://blog.ise.io/hs-fs/hubfs/Screenshot%202026-09-22%20at%2010.57.10%20AM.png?width=309&height=310&name=Screenshot%202026-09-22%20at%2010.57.10%20AM.png)

## Principles of Social Influence

### Authority

Authority is exactly what you think it is. It’s the act of impersonating trusted individuals or institutions. Here’s an example of an attempt I got via email a few months ago from someone pretending to be our CEO.

![Screenshot 2026-01-27 at 9.53.56 AM](https://blog.ise.io/hs-fs/hubfs/Screenshot%202026-01-27%20at%209.53.56%20AM.png?width=768&height=313&name=Screenshot%202026-01-27%20at%209.53.56%20AM.png)

I knew almost immediately that this was not from him, for a few reasons (and if you personally know our CEO, you’ll also know right away that this is not from him!). The clearest indication was that, despite what my title may mean to some, I do not handle internal events, activities, awards, or similar initiatives. Additionally, what does confidentiality have to do with sensing appreciation? I won’t be listing the other indicators here, as doing so could unintentionally help future social engineers refine their tactics. Instead, I encourage you to apply what you have learned from our previous blogs on this topic and evaluate the email copy for signs that it was not sent by the person it claims to be.

### Reciprocity

The second principle of social influence that is commonly used is reciprocity. Reciprocity is the inherent expectation that when you are treated well, you respond in kind. For example, let’s say your company is looking for a vendor for their third-party testing. Their sales rep takes you out for a business dinner at the finest restaurant in your area. After the dinner, they request a concession in the contract. You may be more likely to give this concession after having a high-quality experience at dinner. In the case of a social engineer trying to exploit you, they may offer a minor favor or helpful service first, such as “fixing” a tech problem you did not even know you had.

### Social Proof/Unity

The third principle of social influence is social proof. Social proof is a psychological phenomenon that occurs in social settings when people are unsure of how to act. When people are unable to determine this on their own, they mimic the behaviors that they see. In a social engineering-based attack, social proofing is used to manipulate individuals into taking actions that they might otherwise not engage in. Let’s consider the example of this below.

In a social engineering attack, the attacker is going to create a believable situation in order to lower the target’s natural suspicions. For example, if they are trying to gain access to your banking information, they may set up a fake website with goods that will never be delivered to you. You are innocently scrolling social media and see an ad for new holiday decorations, which you have been wanting. You start scrolling through the numerous positive reviews that were unknowingly left intentionally by the social engineer. Based on the “good” reviews, you decide to purchase some new decorations without questioning the site’s legitimacy, and in the process of checking out you volunteer not only a credit card number, but your full name, address and other personal information. They may have even convinced you to set up an “account” which is just an excuse for you to voluntarily provide more Personal Identifiable Information (PII).

## Countering Psychological Exploitation

Now that we’ve covered several of the most common methods attackers use to make social engineering so effective, you may be wondering what you can do to protect yourself and your organization from this type of cybersecurity threat. The key is to recognize that these attacks are designed to influence how you think and react in the moment, by creating pressure, urgency, trust, or a false sense of familiarity. Because of that, the best defenses are not limited to technical controls alone; they also create techniques to counter psychological exploitation. This includes practical strategies that slow down decision-making, interrupt emotional triggers, and establish clear boundaries before an attacker has the chance to take advantage of them. Below are several approaches that can help reduce social engineering exploitation risk.

1. **Force Intentional Decision Making**
   
   If you recall from earlier in the blog, we discussed how social engineers force System 1 thinking. They create scenarios that cause you to act out of character and irrationally. To combat this, you can establish a few ground rules for yourself that forces System 2 thinking. For example, let’s say you get an “urgent” text message about fraud from your bank. Take a good 30 seconds to yourself. Pause and consider why this “urgent” message can’t be dealt with later. “What happens if I handle this in one hour instead of right now?” Real emergencies will rarely break if you pause a moment to double-check the situation. Next, don’t click the link in the text. Instead, open up your mobile app or web browser and head to the bank website directly, or call the phone number that can be found on the back of your debit or credit card.
2. **Resist Authority**
   
   This may sound like an odd suggestion, but the true point is to treat unexpected authority figures with a healthy level of skepticism, especially when they are asking you to act quickly, share information, approve a request, or bypass a normal process. Social engineers often rely on titles, urgency, and confidence to make a request feel legitimate before you have time to question it. For example, let’s say an unknown person claiming to be a new member of your third-party IT team reaches out about a problem with your computer. If your device appears to be working normally, or if the request seems unusual, you should verify the person’s identity and the issue through an approved channel before taking any action. That may mean contacting your internal IT team, using a known support number, checking an official ticketing system, or confirming the request with a supervisor. To support this habit, establish personal and organizational rules that cannot be overridden by rank, pressure, or implied consequences. Additionally, leadership needs to state what kinds of requests they would and would not make, and the methods in which they would do so. Standardizing verification protocols can make things easier on your team while also making it so that someone unauthorized cannot bypass security controls. A legitimate authority figure should not object to reasonable verification, and pausing to confirm a request can prevent an attacker from using assumed authority to gain access, collect sensitive information, or influence you into making a risky decision.
3. **Reduce Contextual Vulnerability**
   
   It may shock you how much of a digital footprint you leave behind on social media. Attackers use these details to make their pretexts believable. Restrict public profile setting and avoid posting real-time location updates. This is not just a good cybersecurity safety tip, but a personal safety tip too. Criminals of all kinds use social media to find victims. If a burglar sees on vacation that you are out of the country for the next week and they know where you live because you’ve posted your address on Facebook, you can say goodbye to all of the sweet electronics and jewelry that you forgot to put in the safe!
4. **Normalize Safe Friction**
   
   Safe friction is the intentional practice of building deliberate security checks, operational pauses, and verification stems into your daily habits. Doing this helps prevent split-second emotional manipulation. Some ways to do this are to pay special attention to your multi factor authentication (MFA) requests. Attackers can easily exploit SMS based authentication through SIM-swapping or real-time phishing kits. Time-based one-time password (TOTP) authenticator apps can be a great tool to lean on. You could also mandate hardware security keys, which physically bind authentication to the legitimate site domain, making phishing near impossible.
   
   You should also refuse unsolicited MFA push notifications. Threat actors can launch “MFA Fatigue” attacks where they are literally flooding your phone with push notifications in hopes that you will approve the request just to stop the texts from coming through. You should treat every uninitiated prompt as an active attack. Reject all requests, immediately change your password, and report the incident to your IT department, even if you have a [separate work phone](https://research.edgehill.ac.uk/en/publications/byod-security-using-dual-process-theory-to-adapt-effective-securi/).
5. **Verify Claims and Practice Conscious Skepticism**
   
   Before buying a car, you likely are doing a bit of homework first. You might ask friends and family what they drive and their opinion of the vehicle. You might research online or talk to car sales teams about different brands and models. You’re probably looking at things like safety features, reliability, functionality, etc. You should incorporate some level of research to many areas of online engagement. Never rely solely on website reviews or testimonials, social media comments, on unverified peer claims. Utilize independent review platforms or official domain registries to cross-reference vendor legitimacy (because if it seems too good to be true, it probably is!). Or ask a friend!

Social engineering isn’t going away. If anything, AI is [actually helping](https://blog.ise.io/blog/ai-enabled-attack-vectors-how-generative-ai-is-changing-cyberattacks) social engineers refine their craft, making them faster and more accurate. The number of social engineering victims will likely continue to increase as social engineers become more skilled and refine their toolkits. The list we’ve provided of ways to combat these types of attacks both personally and professionally is not exhaustive, but it is a good starting point. No one is safe from a social engineering attack, and building the knowledge into your organization and your personal life is kind of like wearing a seat belt; hopefully you never need it, but you’ll be awfully grateful it was there when you did.

It’s time to go beyond hypothetical threat modeling. At ISE, our penetration testing directly incorporates advanced social engineering tactics to evaluate how effectively your team reacts to manipulative techniques and shows true operational impact if defenses are breached. By testing both technical infrastructure and employee resilience, our ethical hackers provide the comprehensive validation needed to secure your most critical assets against modern exploits. If your team needs guidance on how to better prepare for social engineering based attacks or would like to learn more about our ethical hacking services, [contact](https://offers.ise.io/ask-an-expert) a member of our team for assistance on how to build a strong threat model for your organization.

## Subscribe to Our Blog

##### Stay up-to-date on the latest ISE and cybersecurity news.

We're committed to your privacy. ISE uses the information you provide to us to contact you about our relevant content, products, and services. You may unsubscribe from these communications at any time. For more information, check out our privacy policy.

 

![logo-text](https://blog.ise.io/hs-fs/hubfs/Brand%20Images/Logos/logo-text.png?width=276&name=logo-text.png)

 

###### About

[Company Values](https://www.ise.io/about/values/)

[Methodology](https://www.ise.io/about/methodology/)

[Leadership](https://www.ise.io/about/leadership/)

[News](https://www.ise.io/news/)

[Careers](https://www.ise.io/careers/)

###### Services

[Assessments](https://www.ise.io/services/vulnerability-assessments/)

[Software Development](https://www.ise.io/services/secure-software-development/)

[Consulting](https://www.ise.io/services/security-consulting-services/)

[IoT Village](https://www.iotvillage.org/)

[Training](https://www.ise.io/services/training/)

###### Research

[Studies & Papers](https://www.ise.io/research/)

[Talks](https://www.ise.io/talks/)

[Blog](https://blog.securityevaluators.com/)

###### [Contact Us](https://www.ise.io/contact/)

###### [Privacy Policy](https://www.ise.io/privacy-policy/)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Dr. Rachael Tubbs",
    "url" : "https://blog.ise.io/blog/author/dr-rachael-tubbs"
  },
  "dateModified" : "2026-10-05T07:00:00.811Z",
  "datePublished" : "2026-10-05T07:00:00.000Z",
  "headline" : "Why Social Engineering Works: Psychology and Practical Defenses",
  "image" : [ "https://blog.ise.io/hubfs/Canva%20images/Canva%20Design%20DAHWfROvuOQ.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.ise.io/blog/why-social-engineering-works-psychology-and-practical-defenses",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.ise.io/hubfs/Brand%20Images/Logos/logo.png"
    },
    "name" : "ISE"
  }
}
```