In IT there’s an inelegant but brutally honest acronym: PEBKAC, “Problem Exists Between Keyboard And Chair”. Translated plainly: the problem sits between the chair and the keyboard. It’s not the firewall failing. It’s not the antivirus asleep on the job. It’s the person in front of the screen who clicks. Who types a password where they shouldn’t. Who trusts a message because it’s well written. That’s what social engineering is about. And that’s what this column is about too, carrying the same slightly ironic name.
Falling for it doesn’t make you stupid. That needs saying from the very first article. Social engineering works because it leans on perfectly ordinary human levers. The rush of someone clearing thirty emails. The instinctive respect for a boss or a bank. The trust in a supplier you’ve known for years. Nobody is immune, myself included on an off day. This column isn’t a list of blunders to mock. It’s a space where I tell real stories. I gather them along the way, while working with clients, so we learn to spot the techniques before they spot us.
The psychological levers behind social engineering
In practice, social engineering recycles the same four levers, well described in the Wikipedia entry on social engineering too. The first is artificial urgency: fake deadlines, “the payment is blocked”, “reply within the hour”. The second is fake authority: an email that looks like it’s from the owner or the bank. Signature and logo convincingly copied. The third is familiarity: a real supplier, a real colleague, a number you already know. The fourth is the fear of losing something: access, an invoice, a confirmed booking. Spotting these four levers is already half the job. It matters for anyone who manages an inbox every day.
I’ve already told the first case in full. It’s an attempted hotel phishing scam that reached a hospitality business manager, complete with real screenshots of the scam email and the details that gave it away. From here on I’ll add new cases as they come, one at a time. No names, and no details that could identify anyone.
Social engineering isn’t going away. Only the pretext changes, not the underlying mechanics. That’s exactly why it’s worth studying calmly. Not once the suspicious email has already landed and your heart’s beating a little faster.
If something odd lands in your inbox over the coming months, write to me. We’ll look at it together. If it’s a useful case, it might end up, anonymised, in the next instalment of this column.
Leave a Reply