Why Scams Work: The Psychology Behind Urgency, Fear, and Trust
Updated: 5 days ago
How criminals use normal human decision-making to influence our choices—and what we can do about it.
A 7-part series about why urgency, fear, authority, trust, scarcity, and emotional connection can derail good decision-making—and why understanding the psychology of scams matters.
Introduction
When we talk about scams, we often focus on the warning signs people missed:
Why did they click the link?
Why did they send the money?
Why didn’t they realize something was wrong?
These questions can make fraud sound like a problem of carelessness or a lack of intelligence.
I think that misses something important.
Many scams succeed because criminals understand how people make decisions. They create situations designed to make us react quickly, trust familiar signals, respond to emotion, or rely on the mental shortcuts we use every day.
In other words, scammers don’t always need to hack the technology when they can influence the person using it instead.
Research supports this more complicated view of fraud victimization. A systematic review of the psychology of Internet fraud found that susceptibility cannot be explained by one personality type or demographic group. Instead, fraud involves an interaction among the message itself, a person's experience and knowledge, and the circumstances in which that person is making a decision. The researchers also found that fraudulent messages deliberately use factors such as trust, social influence, scarcity, and urgency to encourage a response. Springer
This distinction matters. The lesson isn't that people are careless.
It's that criminals deliberately manipulate normal human decision-making.
Social engineering is really about influence
Cybersecurity discussions sometimes make social engineering sound highly technical. At its core, though, social engineering is about persuasion.
A criminal wants someone to take an action they otherwise might not take: click, respond, disclose information, transfer money, approve a request, or continue a conversation.
Research that examined phishing emails has found that persuasion is woven directly into these messages. In Ferreira and Teles, for example, analyzed phishing subject lines and developed a framework of persuasion principles used in social engineering, concluding that even a few words can carry substantial persuasive power. ScienceDirect
Another study analyzing 887 phishing emails found repeated use of established persuasion principles, including authority, scarcity, liking/similarity, social proof, reciprocation, and commitment/consistency. Sage Journals
The exact combination varies from scam to scam. So I don't think of urgency → fear → authority → trust → scarcity → emotional connection as six steps that every criminal follows in order.
I think of them as six psychological levers; a convincing scam may pull several of these at once.
In this 7-part series, I examine each one of these persuasion principles in the context of cybersecurity awareness. Tomorrow, I will take a look at urgency.
Selected scholarly research
Ferreira, A., & Teles, S. (2019). Persuasion: How phishing emails can influence users and bypass security measures. International Journal of Human-Computer Studies, 125, 19–31. https://doi.org/10.1016/j.ijhcs.2018.12.004
Norris, G., Brookes, A., & Dowell, D. (2019). The Psychology of Internet Fraud Victimisation: A Systematic Review. Journal of Police and Criminal Psychology, 34, 231–245. This is an especially useful foundation for the article because it synthesizes research on message, experiential, and individual factors rather than portraying victimization as a simple personal failing. https://link.springer.com/article/10.1007/s11896-019-09334-5
Zielinska, O. A., Welk, A. K., Mayhorn, C. B., & Murphy-Hill, E. (2016). A temporal analysis of persuasion principles in phishing emails. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 60(1), 765–769. https://doi.org/10.1177/1541931213601175
Comments