Social engineering is frequently used in computer attacks as well as in other forms of on-line fraud. Scammers rely on psychological factors to lower the victim’s guard or otherwise make him more susceptible to persuasion. These factors include:
- Greed: The wish to have more money
- Laziness: The desire to do less work
- Social compliance: The need to fit in
- Transitive trust: The reliance on trusted brands
- Narcissism: Focus on concepts relevant to oneself
Other psychological tendencies are used during social engineering as well, but I'd like to limit this note to just five, because their use by scammers is nicely illustrated in the following example.
Consider the following website, currently hosted at a number of domains, including www (dot) news-6-insider (dot) com, which advertises a "Home Income Kit":
Lets take a look at how this website uses elements of social engineering to persuade visitors into ordering the kit.
Greed: The Wish to Have More Money
The website promises to reveal a way for making good money: "$5,000-$7,000 a month." Who wouldn’t want to know how to do that? There are plenty of people who are struggling to make a living, especially in a bad economy, who would jump on the opportunity to earn such income. (So "greed" might not be the best way to describe this factor.)
Laziness: The Desire to Do Less Work
Not only does the website describe the ability to make good money, but it also emphasizes that the person can do this while working online "10-15 hours a week from home." And all one has to do is to "post links." Sadly, if something sounds too good to be true, it probably isn’t true.
Social Compliance: The Need to Fit In
Though we often strive for individuality, most people look at others in their community when deciding what to wear, eat, drive, read, and so on. That’s partly why link-sharing on social networking sites is so popular. This website incorporates an element of social networking by plugging into Facebook:
The implication is that if 558 people on Facebook like it, the site is probably legit. More powerfully, if you were logged into Facebook when visiting this site, you would see who from your social network liked this page.
Similarly, the website presents what appears to be fake comments of people extolling the benefits of the advertised offer:
One of the comments even includes a photo of a check, eliciting the following (fake) response: "Holy cow Dennis! Thanks for posting that screen shot, you just gave me the inspiration I needed. Wow! :-)"
Transitive Trust: The Reliance on Trusted Brands
Rather than advertising the "Home Income Kit" directly, the website looks like a typical news story, reported by "News 6 Insider." It also mentions trusted news-reporting brands, such as ABC, BBC and CNN. Surely, if this offer was discussed on those networks, it must be legit, right?
Another instance of this site, reported as a scam in April 2010, includes a video shot as a news report. This is another attempt to add legitimacy to the advertised offer.
Narcissism: Focus on Concepts Relevant to Oneself
People tend to pay more attention to the concepts that are relevant to themselves. This website attempts to customize its text to use the name of the town or city where the visitor is located. Presumably, it inserts the name of the locale by looking up the visitor's IP address in a gelocation database:
The Fine Print
The website almost comes clean about its intentions in the fine print that appears in its footer:
"It is important to note that this site and the stories depicted above is to be used as an illustrative example of what some individuals have achieved with this/these products. This website, and any page on the website, is based loosely off a true story, but has been modified in multiple ways including, but not limited to: the story, the photos, and the comments. Thus, this blog, and any page on this website, are not to be taken literally or as a non-fiction story."
In other words, the text of the website is fiction.
The fine print also mentions the cost of the kit:
"After the 7 days, on Day 8, if you decide to keep the iSpeedway program, it will be yours for the first time single payment of $129.95. After the frist installment, the subsequent fee is $69.95 a month. The monthly fee includes hosting on the iSpeedway server, access to the drop ship warehouse, unlimited technical support on toll free numbers and online help. The monthly fees following the 7 day trial are charged to the credit/debit card on file that was used for the activation/licensing fee."
Clicking on a link to obtain the "Home Income Kit" will take the visitor to a tracking URL on jmp7 (dot) com, which will redirect to a page on affiliate (dot) gmtracker (dot) com, which will redirect to various pages, such as those hosted on www (dot) homebizstartupkit (dot) com and join (dot) eprofits (dot) com:
The page explored here is worth examining in some detail, so I recommend taking a look at its full contents without actually visiting the website that hosts it. To do this, take a look at the the PDF version of the website's contents. What additional persuasion tactics can you find there?