Nothing Special   »   [go: up one dir, main page]

Understanding The Psychology of Scam Victims

Download as docx, pdf, or txt
Download as docx, pdf, or txt
You are on page 1of 3

Understanding the psychology of scam victims

Frank Stajano and Paul Wilson (wearing suits... up to something?)

The paper
I have a particular interest in the human aspects of systems security. With Paul Wilson, co-author
and co-presenter of the BBC TV show The Real Hustle, in this study we help you understand the
psychology of scam victims in order to improve systems security.

Frank Stajano and Paul Wilson. "Understanding scam


victims: seven principles for systems security". University
of Cambridge technical report UCAM-CL-TR-754, August
2009.
(click paper title to download full text)

Abstract
The success of many attacks on computer systems can be
traced back to the security engineers not understanding the
psychology of the system users they meant to protect. We
examine a variety of scams and “short cons” that were
investigated, documented and recreated for the BBC TV
programme The Real Hustle and we extract from them
some general principles about the recurring behavioural
patterns of victims that hustlers have learnt to exploit.
We argue that an understanding of these inherent “human
factors” vulnerabilities, and the necessity to take them into
account during design rather than naïvely shifting the
blame onto the “gullible users”, is a fundamental paradigm
shift for the security engineer which, if adopted, will lead to
stronger and more resilient systems security.

This work is featured as an invited talk at Usenix Security 2010 and an abridged version of the
report has been accepted for publication in Communications of the ACM.

The principles
1. Distraction principle. While you are distracted by what retains your interest, hustlers
can do anything to you and you won't notice.
2. Social Compliance principle. Society trains people not to question authority. Hustlers
exploit this “suspension of suspiciousness” to make you do what they want.
3. Herd principle. Even suspicious marks will let their guard down when everyone next to
them appears to share the same risks. Safety in numbers? Not if they're all conspiring
against you.
4. Dishonesty principle. Your larceny is what hooks you initially. Thereafter, anything
illegal you do will be used against you by the fraudster.
5. Deception principle. Things and people are not what they seem. Hustlers know how to
manipulate you to make you believe that they are.
6. Need and Greed principle. Your needs and desires make you vulnerable. Once hustlers
know what you really want, they can easily manipulate you.
7. Time principle. When you are under time pressure to make an important choice, you use
a different decision strategy. Hustlers steer you towards one involving less reasoning.

Here is a summary of how the principles (columns) are used in the scams (rows) described in
the full paper. A full dot means the principle is of major importance for that scam, while a
hollow dot means it's used but less important.
In a follow-up work, of which we presented a preliminary version at Security and Human
Behaviour 2010, we revise this taxonomy based on a comparison with the related ones compiled
by Cialdini in Influence: science and practice and by Lea et al in their OFT report on the
psychology of scams.

You might also like