Social engineering and the use of persuasion to commit cyber fraud

Abstract

The use of social engineering in cyberattacks has increased in recognition. The gap in understanding is how the various aspects of psychology influence the outcome of social engineering attacks. In this paper Cialdini’s principles of persuasion are discussed in conjunction with neuroscience. Additional insights are introduced, including how biases function within the structure of a business e-mail compromise (BEC) e-mail and what part the persuasion principles play in the structure of the e-mail and the requests. Additional context is provided with examples to clarify the concepts of the various topics discussed. Previous research has focused on isolated disciplines of psychology and its use in phishing attacks. This singular focus has failed to address the various nuances which take place with a social engineering attack. Referencing Cialdini’s extensive work in persuasion as well as social hierarchies and the role of physiology in decision making allows for additional insights to be explored. This unique perspective will offer a more holistic understanding of the aspects that influence decisions a person makes when targeted by a social engineering attack.