How cybercriminals exploit the way we make decisions

What it is:  We tend to favor information and facts that support beliefs and assumptions we already hold.  On the flip side, we avoid seeking disconfirming evidence and often seek to discredit information that contradicts our beliefs.

How cybercrooks exploit it:  If a cybercriminal knows that we are predisposed towards a product, cause, or belief, it is much easier to get us to click on a link that purports to support and bolster that product, cause, or belief, or to click on a link that discredits the opposite view or belief.

Knowledge is power:  Be wary of emails, texts or other communication from unknown sources that line up too perfectly with things you believe, like, or favor. Understand that cybercriminals try to build a bridge to suit you based on common interests they have identified.

Information security tip:  Move your cursor over a link (don't click!) to hover over the URL to reveal the actual destination of the page it connects to. If the link text says you are going to “Amazon” but the actual link URL looks something like this —http://amaozon.support.com— this is a major red flag.

What it is:  The Groupthink Trap is the tendency to be overly influenced by what others are doing and giving too much credence to others' opinions and judgments.

How cybercrooks exploit it:  Cybercriminals often indicate that many others have benefitted from responding in a certain way, trying to create the expectation that a similar response by you will lead to the same benefit. Or, they gain access to your network of friends and send you something that suggests that your friend tried this, clicked on it, and got a positive result.

Knowledge is power:  In our fast-moving world, going along with the group consensus is an easy mental shortcut.  When you see a recommendation to click on something from someone you know or from a group or organization you are likely to trust, you should investigate carefully before acting. Reach out to a person via another channel to see if this ‘recommendation’ is really from them.

Information security tip:  Always verify the sender before responding or clicking on a message if something feels off. Reaching out to the person via their verified phone number is a quick, additional step you can take to remain secure from a suspicious message.

What it is:   Snap judgments are quick decisions we make based on narrow slices of information.  We couldn’t get through a day without making hundreds of them, and many are accurate. The errors occur when we unconsciously rely on appearance and other surface attributes that may be misleading, or the inaccurate pre-judgment of information based on the person or the source delivering it. In many ways this trap is one of the most predictable and often exploited decision traps.

How cybercrooks exploit it:  One way they do it is by impersonating a figure of authority. For example, they might craft an email that supposedly comes from your CEO or someone in a leadership position pressuring you to fulfill an online task:

“Dear Sean, I want to thank you for being such a great employee.  By the way, I have a quick request.  Could you…”

Variations on this include a scammer imitating an email from a different department in the organization to gain information from you, and hence you click on an email that has been carefully designed to look like it is an urgent work message from HR, only for it to be a scammer stealing your login credentials for the office.

Another way they exploit this decision trap is by creating fake identities from reputable sources because most people tend to be responsive to people or institutions with an established level of prestige, authority, or power (like a government department, your bank, a law enforcement agency, or an organization with brand power). This is because cybercrooks know that people will often make a snap judgment based on the perceived status or reputation of the sender. (In social engineering parlance, this is also known as building rapport.)

Another way they exploit this trap is by combining name recognition with urgency:

 “Hey Candice, can you quickly send me your cell number? I’m at a conference and need to give it to one of the participants who has a question I know you can answer.”

Today we are all moving so quickly, often checking email and messages on our phones, it’s easy to fall victim and respond in a hurry before checking the sender’s address closely. Our brain sees the name of our boss, and we immediately shoot back a response.

Knowledge is power:   Be vigilant about giving undue weight to whomever the sender “seems to be” in requests.  If you find yourself responding too quickly because you assume you should, given the supposed authority of the sender, slow down and first verify that the sender is legitimate. Also be wary when something is presented as a sure bet. Our snap judgment tendencies can trick us into perceiving it as the best option.  Also watch for one-sided phrasing of options when making a choice.

Information security tip:  To escalate phishing emails safely, forward the message to “7726” which ironically spells out the word SPAM on most phones. This will launch an investigation into the message by your provider.

What it is: Humans are wired to avoid loss.  We also tend to make new choices to justify past decisions and we can be overly influenced by costs or investments from the past that can’t be recovered.

How cybercrooks exploit it:  Hackers understand our automatic desire to avoid loss and will indicate that a failure to act or respond will result in some type of penalty, end of a relationship, or loss of status.  The malicious messages are framed in such a way that predisposes us to act to avoid the loss.  For example, hackers often try to entice us with links to “avoid losing out on this opportunity” or "avoid losing access to your account.”

In terms of the related Sunk Cost Trap, cybercrooks know we are more likely to follow through with something if we have already invested time or money, regardless of whether those costs outweigh the benefits.  For example, they may first entice you to contribute a very small amount of money or time, often disguised as an effort to help someone in need. Later, because you already invested a small sum, you are more likely to send a larger amount. This is also sometimes called the “escalation of commitment trap.”

Knowledge is power:  Whenever we are presented with something framed as a “loss” to avoid, or when an initial small commitment is all that is being asked for, be wary. Question the legitimacy of the offering.

Information security tip: Consider calling the source or going to the original trusted website to review the request you have been prompted for. It’s much more secure to go to the original source rather than trust a notification with a pressing tone.

What it is:  With the Anchoring Trap, we remember (anchor on) one piece of information in a way that potentially skews our judgment on something else.

How cybercrooks exploit it: Many banks now offer an “opt-in” option to get a text alert if there is suspicious activity on your account or if you are in danger of overdrawing your account. So you opt in, knowing that getting notified about such things is good.  Unbeknownst to you, this decision to opt in to protect your account becomes an “information anchor” in your brain. Later, a cybercriminal sends you text pretending to be your trusted bank indicating that they need a payment transferred quickly because an overdraft alert has been prompted.  Remembering that you opted in (the original information anchor), and because the request seems urgent (triggering Snap Judgment Error) and there might be some penalty if you overdraw your account (triggering Loss Aversion), you respond to the text to initiate the transfer.

Knowledge is power:  When you find yourself basing a new decision on some past decision or piece of information, your first instinct should be to take a moment to consider if there has been a prior piece of information that could be influencing you right now.  Then take the time to verify the request's legitimacy. When something feels off or the request relates to a prior piece of information you received or made a decision about, it is truly better to listen to your gut and be cautious.

Information security tip: Do not provide personal information or details about your organization unless you can verify the person’s identity and authority to have the information.

What it is: The Availability Trap is the tendency to give undue weight when making decisions to recent memorable or particularly sticky events, trends, and happenings in the world around us. When news is dramatic, vivid, or connected to something we care about, the Availability Trap can skew our decision-making.

How cybercrooks exploit it:  Email isn’t the only tool the bad guys use to phish for your information. Vishing, or “voice phishing” attempts via malicious phone calls are often used to exploit recent information in the news.  For example, the pandemic provided ample opportunities for scammers to tap into this trap by offering, for example, free COVID test kits or information about PPE loans.  Currently we have lots of news about rising interest rates and volatile stock markets. Think about the opportunities that creates for vishers.

Vishing calls often come from a phone number you may recognize or a local area code. Once they have you on the line, the call quickly escalates to asking for your personal information, such as your name, address, payment information, and more.

Knowledge is power:  The uncertainty of our times, along with social media amplification, means that we are living in world where there is a constant flow of dramatic and sticky news.  When you are contacted about something that you’ve just recently heard about or something that seems to be very connected to something you care about, be aware that the Availability Trap could hijack your decision-making.

Information security tip: If you’re unsure a phone call is legitimate, hang up and try contacting the organization directly using their official phone number or website. Better yet, don't answer calls from unknown sources.