Many people imagine cyber criminals attacking computers, networks and software when they think of cyber attacks. In reality, some of the most effective attacks expose vulnerabilities in the human psyche.
From taking comfort in familiarity to our belief that we're good at detecting lies, cyber attackers often exploit mental shortcuts we employ day to day.
The most surprising part is that these hacks work no matter how intelligent or cautious the individual may be.
There isn't necessarily one trick we fall for, but three.
You may also like:
- Why hackers play Capture the Flag to prove their skill
- What do blue and red teams do in cybersecurity?
The illusory truth effect
What is the illusory truth effect?
First established in a series of findings in 1977, the illusory truth effect has shown that repeated information increases perception of truth. For instance, one later study found that repetition increases belief in claims that are implausible or contradict prior knowledge.
Interestingly, the illusory truth effect can still persist even if the individual is aware that the source's credibility isn't to be trusted. In our era of rampant social media use, you could say the effect is in full swing whenever one scrolls social media and is subjected to countless pieces of misinformation.
And now with the advent of AI, a study has found that those who rely on social media for news are found to be more susceptible to deepfakes.
What does this mean?
Familiarity breeds trust and can override scepticism for a split-second – long enough to fall victim to a cyber attack. A criminal might send you a login page displaying a familiar logo, with a polished layout that all seems similar to those you may have encountered before.
This easy-to-process information loosens our scrutiny and before we know it we've clicked the URL without checking it properly. There's a reason why scams nowadays pretend to be from companies you may interact with every day: Microsoft, Google or Amazon, for example.
Most people aren't as good at spotting lies as they think
Many people believe they're great at detecting lies, but are they really?
According to a meta-analysis that synthesised results from 206 documents and 24,483 judges, only 54% correctly distinguished lies from truthful statements on average. This statistic holds firm across biological sexes, genders, different age groups, occupations and even spontaneous or planned lies.
When Uber suffered a significant breach in 2022, the attackers posed as IT support and persuaded a contractor to approve login requests. The cyber attack worked because each layer felt convincing enough to trust.
The information gap
Cyber attacks may prey on our familiarity or employ social engineering tricks, but they also take advantage of something many of us possess: curiosity.
Psychologists have long argued that people gain a burst of motivation when they notice a gap between what they know and what they want to know, a concept known as the information gap.
Attackers exploit this instantly with messages or questions like:
- Is this a photo of you?
- You've been tagged in this document
- Someone logged in on your device
It's the same psychology that makes cliffhangers unbearable and clickbait difficult to resist.
Why cybersecurity increasingly feels like detective work
Modern cyber investigations rarely involve a single obvious clue. Instead, investigators must piece together a trail of evidence to gain a better understanding of the vulnerability that was exploited.
That's why cybersecurity challenges are moving away from traditional lessons and more towards gamification, puzzles and taking on realistic challenges. The goal isn't necessarily to absorb information but more about recognising patterns and spotting inconsistencies.
