Urgency, authority, scarcity: the six levers in every scam

Series: How minds are moved · Social engineering: the attack on one mind at a time · 2 of 6

In 2025, Americans reported losing $20.9 billion to online crime, according to the FBI’s Internet Crime Complaint Center. That was a record, from 1,008,597 complaints, the first year the total passed a million. Almost none of that money was taken by breaking encryption. It was handed over by people who had been made to feel something at the right moment.

This week, on LSN News, my news engine, an Associated Press story ran across 47 outlets about an 81-year-old former book editor. A pop-up and a voice on her computer told her that thieves were about to take $35,000 from her bank account and that she had to move the money now. That one sentence pulls two levers at once: authority (the bank’s voice) and scarcity (now, before it is gone). This post is about all six levers.

Contents · 10 sections

TL;DR #

• The social psychologist Robert Cialdini named six principles that make people say yes without thinking: reciprocation, commitment and consistency, social proof, liking, authority and scarcity. A 2021 edition of his book added a seventh, unity.
• Every scam I have read about pulls at least one of them, and most pull two or three.
• Studies of real phishing email disagree on which lever is used most, but authority, scarcity and liking keep coming out on top.
• My honeypots show the other side: machines don’t need levers. They try the passwords people never changed.
• The defence is to notice the feeling, then slow down. A lever only works while you are hurrying.

Cialdini’s “click, whirr” #

Cialdini’s Influence: The Psychology of Persuasion is on my library shelf, and its first chapter is still the best introduction to the problem. He describes animals that react to a single trigger feature with a fixed pattern of behaviour, “click, whirr”, and then points out that people do the same. Most of the time these shortcuts serve us well. Cialdini calls them “weapons of automatic influence” and adds that they work for anyone who knows how to pull them, including people who use them against us.

One of his stories stays with me. A jewellery shop could not sell some turquoise pieces. The owner left a note asking for the price to be cut in half. The assistant misread it and doubled the price instead, and the pieces sold out. Buyers who knew nothing about turquoise took “expensive” to mean “good”. No one lied to them. A shortcut did the work.

Scammers use the same shortcuts, only on purpose.

The six levers, mapped onto real scams #

Authority. We obey people who look as if they have the right to ask: a bank, the police, the tax office, the CEO, Microsoft support. In fake tech-support and “bank security” scams, the scammer plays the authority. In business email compromise, the CEO or the finance director “sends” the payment order. The FBI counted $2.77 billion in reported business email compromise losses in 2024 alone.

Scarcity and urgency. Things become more desirable when they are about to disappear, and decisions get worse when a clock is running. “Your account will be suspended in 24 hours.” “This investment window closes tonight.” “Your grandson needs bail before the court closes.” Urgency also blocks the one thing that would save you, which is checking.

Reciprocation. We feel we owe something to people who gave us something first. Scams open with a gift: a “refund” that was paid by mistake and must be sent back, a free consultation, a bonus credit on an investment platform. The gift is fake. The feeling of owing is real.

Commitment and consistency. Once we have taken a small step, we keep acting in line with it. Investment scams start with a tiny deposit that “earns” a visible profit and can even be withdrawn. Every later deposit is consistent with the first good decision. Romance scams work the same way, one confidence at a time.

Social proof. When we’re unsure, we do what people like us seem to be doing. Fake reviews, group chats full of “members” posting their gains, comment sections packed with grateful testimonials. Often most of the crowd is the scammer’s own accounts.

Liking. We say yes to people we like, and we like people who are similar to us, praise us and seem to share our values. Romance scams are pure liking. So are the friendly “wrong number” chats that turn into investment advice, which I cover later in this series.

Unity, the seventh principle Cialdini added later, is shared identity: “we” are family, the same faith, the same nation, the same company. “As a fellow member of the community” is a phrase to watch for.

What the research on phishing found #

Researchers have coded real phishing emails against Cialdini’s list. A 2014 study of 207 emails from a Dutch database found authority and scarcity were the most common levers. A replication on 52 emails found liking most common, followed by scarcity and authority. A study of 887 phishing emails received at three universities between 2010 and 2015 found that commitment and scarcity became more common over time while reciprocation and social proof became less common. A 2025 study of 300 samples found scarcity was the most frequent lever, but liking and authority were the best predictors of whether people were actually fooled.

The samples are small and the coding differs, so I won’t rank the levers. The pattern is still clear: a scam almost always carries a figure of authority, a clock, or a friendly face, and usually more than one.

The other side: what a machine tries #

My own honeypots give a useful contrast. Since 21 March 2026 they have recorded 831,443 login attempts against fake servers, using 178,935 different username and password pairs. These are automated scripts, not people, and they use no levers at all. They don’t need to. They try what people leave unchanged.

The most-tried password was 123456, used 56,425 times by 3,354 different addresses. Next came admin and an empty password. The single most-tried pair was admin with admin, 33,201 times. Other favourites are password, root, P@ssw0rd and abc123. I give counts only here, no addresses and no attribution.

That’s the line between the two kinds of attack. Machines attack defaults, the things people didn’t change. Social engineers attack feelings, the things people can’t switch off. Both rely on the same human habit, which is not stopping to think.

What it feels like from the inside #

A lever doesn’t feel like manipulation. It feels like a normal reaction to a real situation.

• Authority feels like relief: someone competent is handling it.
• Urgency feels like responsibility: if I don’t act now, it’s my fault.
• Reciprocation feels like decency: they helped me, so I should help back.
• Commitment feels like consistency: I already decided this was good.
• Social proof feels like safety: all these people can’t be wrong.
• Liking feels like friendship, sometimes like love.

A good scam stacks them, so that each feeling covers the doubts the others might raise.

What levers can and cannot do #

Levers raise the odds. They don’t control anyone. Most phishing emails are ignored, most scam calls are hung up on, and Cialdini’s experiments shift percentages, not whole populations. The effect is strongest when people are tired, distracted, frightened or alone, which is why scammers call older people at home, finance staff at the end of the quarter, and everyone during outages and holidays.

The levers also work in honest settings. Sales, charity appeals, public-health campaigns and political ads all use them. A lever is not proof of a scam. A lever plus a request for money, credentials or secrecy is a reason to stop.

How to notice it #

• You feel rushed. Ask who set the deadline.
• The message invokes authority, but you can’t check it from your own side.
• You have been given something you didn’t ask for, and now you feel you owe something.
• You are being asked for one more step “to finish what you started”.
• Everyone in the chat seems to be winning.
• You like the person very much, you have never met them, and money has come up.
• You are told to keep it secret, even from your bank or your family.

A short rule set:

1. Pause. A real bank, boss or relative will still be there in ten minutes.
2. Verify through your own channel: the number on your card, the colleague’s known phone, a family call.
3. Never move money to “protect” it. Banks don’t ask for that.
4. Never share a code, a password or remote access with someone who contacted you first.

Frequently asked questions #

Which lever is the most dangerous? #

The research doesn’t agree on one. Authority and scarcity show up most often, while liking and authority best predict who gets fooled. In practice the dangerous case is several levers stacked together.

Do people with more education fall for scams less? #

Education helps with some technical lures. Levers target emotion and habit, which are not the same as knowledge. Being tired, isolated or under pressure can matter as much as knowledge.

If honest marketing uses the same levers, how do I tell the difference? #

Look at the request. Honest persuasion lets you check, wait and walk away. A scam pushes you to act now, in secret, through a channel it controls.

Why mention honeypots in a post about psychology? #

Because they show the contrast. Machines don’t persuade anyone. They simply try what was never changed. People are attacked through what they can’t switch off, which is why a pause works better than any filter.

The lesson #

Cialdini’s levers are not a dark art. They are shortcuts that every one of us uses dozens of times a day, mostly to our benefit. A scam is someone pulling those shortcuts on purpose, usually several at once and always in a hurry. You can’t remove the levers, but you can notice the hand on them. When you feel rushed, flattered, indebted or reassured by a crowd, and someone is asking for money or a code, that feeling is your signal to stop and check.