Protect yourself against would-be manipulators by understanding and recognizing their tricks.
Many people think of hacking humans as “manipulating” people. I beg to differ. When you exert influence using techniques presented in the past several chapters, people want to comply with your wishes—they’re happy to help you out. Manipulation is different—and much darker. When you manipulate people, you deviously trick or even force people to comply against their wishes, often causing considerable harm in the process. My team rarely uses manipulation techniques, and I urge you to avoid them entirely. You do have to know about them, however, so that you can protect yourself from nefarious, would-be manipulators.
Years ago, after I was booted out of college but before I became a chef, I used my human hacker skills to get a job selling disability insurance to a customer base composed primarily of farmers. I knew as much about farming and rural life as the next twenty-year-old surfer dude from Florida’s west coast. I knew even less about insurance. But the company took a chance on me, assigning our local office’s top salesman to school me in the art and science of selling disability policies to small, struggling farmers.
What an education that was. The top salesman, whom I’ll call Gregg, lied shamelessly to get farmers to buy much pricier insurance than they actually needed. During a typical sales call, Gregg might have encountered a farmer who, given the value of his farm and the level of income he derived from it, needed $175,000 in disability insurance in case he was injured on the job. Gregg would convince that farmer to buy $1 million worth of coverage, at a much higher monthly premium, by painting a horrifying picture of what would happen if the farmer ever got injured without that kind of coverage. “Your family will lose your farm,” Gregg said, breezing through some numbers he’d come up with. “You’ll be destitute. None of your kids would go to college. Your life will be ruined.”
To lend credence to this scenario, Gregg would invent a supposedly real-life story about a farmer in a neighboring county whose family was now destitute after he’d lost his legs to a piece of machinery. The farmer’s wife was now working at Walmart for six dollars an hour. His kids had dropped out of school; some were working long hours at thankless jobs, others were meth addicts. The farmer was forced to borrow money from his elderly parents just to pay monthly expenses. The family couldn’t even afford health insurance. All because the farmer had signed up for tens of thousands or perhaps a hundred thousand dollars of coverage as opposed to $1 million. If the customer asked to verify the story, Gregg demurred, invoking client confidentiality. “I’m sure you read about it in the paper eight or nine months ago,” he’d say, prompting most customers to nod their heads in agreement.
As we’ve seen, exerting influence entails inducing others to think similarly to you so that compliance with your wishes becomes their idea and in their best interest. Manipulation, by contrast, involves preying on people’s emotions to compel compliance, regardless of how it affects the other person. As Gregg taught me and as I’ve seen countless times since, manipulation is both easy and frighteningly effective (although it isn’t always outright fraudulent, as in the case of Gregg’s behavior). When we experience fear, pain, lust, or other strong feelings, our rational faculties short-circuit and that tiny, walnut-sized chunk of gray matter known as our amygdala takes over—what Daniel Goleman has called “emotional hijack.”1 Gregg mastered this dynamic and applied it shamelessly, triggering an emotional hijacking response at will. His targets went into “fight or flight” mode, making quick, unreasoned decisions. Although a few customers managed to extricate themselves from this trap, asking critical questions and showing Gregg the door, most did exactly as Gregg advised. He notched the sale. They got an onerous monthly insurance bill.
Manipulators like Gregg are everywhere. Although I’d like to think that most salespeople, politicians, attorneys, journalists, and religious figures behave ethically, it’s not hard to find those who fire up our fears, hatreds, lusts, and so on to achieve their goals. Manipulation is also endemic in the corporate world, from Las Vegas casinos that ban clocks and cut off natural light so we’ll lose ourselves at the blackjack table,2 to stores that pump out seductive odors so that we’ll linger and buy more,3 to the billions of dollars in advertising that impel us to buy products and services we don’t need by preying on our emotions. This is to say nothing of the criminal manipulators out there—the countless unsolicited phone calls, emails, and texts that threaten you with various kinds of scary legal action, the loss of your job, or some other disastrous outcome if you don’t provide certain information, pay a fee, or take other action. In addition to generating trillions each year in ill-gotten gains, manipulative scams inflict severe emotional damage on victims. In one horrific case, a man fell prey to a ransomware hack that informed him he had been caught downloading porn and needed to pay over $20,000 in fines. Unable to afford such a large fine, he became so distraught that he committed suicide and killed his four-year-old son.4
As a social engineer, I use manipulation all the time to hack into IT systems and buildings, but only at our clients’ request and within parameters that they set. Although these efforts often don’t leave our targets better off for having met me, the minor emotional stress they cause serves an important purpose: helping companies protect themselves from criminal hackers. In this chapter, I’ll help you protect yourself and stay safe by describing the key forms of psychological manipulation hackers and others use to get what they want, often criminally and at your expense.
There’s another reason to understand manipulation techniques: so that you can stop yourself from inadvertently applying them. It isn’t just unscrupulous individuals and companies who deploy the dark arts to get what they want. All of us do it from time to time, often in small or subtle ways and without thinking much of it. I’m a pretty big dude, and when I fly, it’s a pain sitting by the window and having someone scrunched next to me in the middle seat. If I’m one of the first to board and its unreserved seating, I keep an anxious eye on the passengers filtering in, praying nobody else sits next to me. I hate to admit this, but I’ve sometimes done more than pray. I’ve put my jacket or another personal belonging in the seat, making it seem like it’s taken. I’ve done a little manspreading of my legs and arms, suggesting that anyone with the temerity to sit next to me will enjoy no personal space of their own. And I’ve donned headphones, pretending to listen to music so that passengers will be less inclined to ask me if the seat is taken.
If I were deploying influence to get my fellow passengers to sit elsewhere, I would have engaged them in polite conversation and asked them kindly to sit elsewhere. But on these occasions, I forced them to make a decision on false pretenses by triggering unpleasant emotions: fear of “breaking the rules” or appearing rude if someone has indeed already claimed that seat; or distaste at sitting next to a big, sweaty guy who is seemingly aloof and disrespectful of others’ personal space. My manipulation was selfish, inconsiderate, and disrespectful. Although it didn’t cause grievous harm, it did serve to make my fellow passengers’ days just a little bit harder.
Behavior like this is common in situations when strangers are competing with one another for space or some other scarce commodity. But we also resort to manipulation in small ways when dealing with friends, relatives, and other important people in our lives. When you want your partner to behave in a certain way, do you always approach them in a straightforward and kind manner? Or do you sometimes push them into it by arousing their emotions, suggesting how frightening it might be if they don’t behave as you wish, and how wonderful it would be if they do?
One afternoon, I really felt like eating steak for dinner, and my wife was on a “no-meat” kick. While we were driving somewhere together, I planted images in her mind of delicious meat dishes. “Did you smell that barbecue last night? Man, it smelled amazing!” I talked on and on about grilling and reminded her of some of our favorite grilled meats. Later, I asked casually what she felt like having for dinner. “I don’t know,” she said, “but I’m craving a steak.” We did in fact eat steak for dinner that night—I had manipulated her into setting aside her desire to eat vegetarian. She didn’t suffer negative consequences, but if the situation were different (for instance, if she had heart problems and were avoiding animal protein on doctor’s orders), she might have. Either way, I was behaving selfishly, exploiting her emotional vulnerabilities to comply with my wishes, with no thought of her needs or desires.
If you’re a parent, you probably resort to manipulation to keep your kids in check. When our kids aren’t going to bed on time, doing their homework, or performing their chores, we could engage them in conversation, encouraging them to want to comply with the rules. But it’s hard to do that when we’re stressed or tired. So, we remind them of all that we do for them and make them feel guilty for failing to comply with our simple wishes. We threaten to take away privileges if they don’t comply, arousing fear. We bribe them with the prospect of dessert if they do as we wish. All of these standard parenting hacks are forms of manipulation, however trivial they might seem. Instead of leading with compassion, we strong-arm our way to compliance.
Avoiding manipulation can improve your relationships. It takes more thought and effort, but by choosing to exercise influence in your daily life instead of imposing your will, you’ll become kinder and more compassionate. You’ll listen more, understand others better, deliver to them more of what they want and need, and cultivate rapport and trust. How much rapport and trust do you build with your spouse by subtly eroding her ability to exercise free will when making joint decisions? How much do you build with your kids by promising them candy if they do their homework? I certainly wasn’t doing anything to build a relationship with my fellow travelers by donning my headphones and manspreading. If I had instead explained my situation and kindly asked them to sit elsewhere, I would have given them the opportunity to perform an act of kindness and me the opportunity to feel and express gratitude.
In his book Changeable, the psychologist J. Stuart Ablon describes an approach to relationships called Collaborative Problem Solving (CPS), in which parents, teachers, and others in positions of power don’t force others to comply simply because they can, but instead are “nicer,” engaging in an empathetic conversation with them to arrive at a collaborative solution. As Ablon relates, schools, mental hospitals, and juvenile prisons have seen dramatic improvements in behavior after setting aside traditional discipline and employing CPS. At one psychiatric setting for kids, staff were often forced to physically restrain kids because of poor behavior—in one year, they did so 263 times. A year after introducing CPS, they did so only seven times. The influence techniques described in this book are not the same as CPS, which is a very specific, structured approach. But the success of CPS shows that we need not compel others with less power to behave as we like, whether by manipulation techniques or through disciplinary means. Other options exist that allow us to treat people with respect and build strong, trusting, empathetic relationships with them.5
Although manipulation techniques are quite powerful in social engineering, so, too, are influence techniques. In many situations, they’re often more effective than outright manipulation. Remember Gregg, the lying insurance salesman who trained me? When I started working with him, he was the company’s top-ranked salesperson globally. During my year tenure at the company, I dethroned him, achieving the highest ranking for a full six months. Although I learned a lot from Gregg, I decided early on to adopt an ethical approach. I spoke honestly with customers about their insurance needs and told truthful, verifiable stories about other local farmers who had purchased policies and filed claims with us. The policies I sold were often smaller than Gregg’s, but I sold many more of them. Best of all, I could sleep at night knowing I was helping to fulfill a real need for people and improve their lives.
I can certainly imagine extreme, life-or-death situations where it might prove necessary to manipulate people to compel them quickly to take a desired action. If I were in a hostage situation and I needed the attacker to drop his weapon, I would have few scruples about arousing intense fear in him by describing the SWAT team marksmen and their deadly accuracy. But short of that, you’re so much better off pursuing your own goals and the welfare of others concurrently, while also staying alert to others who might try to use manipulation techniques against you.
You might think you’re pretty good at spotting would-be manipulators. You encounter scams every day on your phone and in your email inbox, and you see right through them. You know enough to take a cynical eye toward advertising and shifty salespeople. Nothing can get by you! Ah, but it can. The sheer pervasiveness of manipulation can make us complacent and hence more vulnerable. We wouldn’t think of responding to a robotized voice message warning us in halting English that we’ll go to jail for some vague reason if we don’t call a certain number and pay an exorbitant fee. But scammers are always upping their game, surprising us with schemes that are increasingly well wrought and believable.
In 2019, the British bank Barclays warned of a scam in which criminals online purported to own a beautiful vacation villa available for rent. The criminals lured unsuspecting vacationers by offering the properties at a steeply discounted rate. They used real pictures stolen from other sites and sported a logo from the United Kingdom’s professional association of travel agents. Dazzled by the prospect of an amazing and seemingly genuine deal, victims unthinkingly forked over money to reserve the property, losing thousands of dollars. Surveying two thousand consumers, Barclays found them to be shockingly vulnerable, with a majority admitting that they would book a property even if it seemed “too good to be true.”6
In another increasingly common scam, criminals call people and claim to have kidnapped a family member, demanding immediate payment of a ransom. They use spoofing technology that allows them to make it seem that the call is coming from the loved one’s phone.7 “Unlike traditional abductions,” the FBI has said, “virtual kidnappers have not actually kidnapped anyone. Instead, through deceptions and threats, they coerce victims to pay a quick ransom before the scheme falls apart.”8 If you didn’t know about these scams, but someone called you up and claimed they would kill your daughter if you didn’t pay them $2,000 in one hour, and if that call seemed to come from her smartphone, you’d probably be terrified and perhaps even pay the ransom.
Unless you’re in the security business or law enforcement, you won’t be familiar with every new scam that pops up. But you can still reduce your chances of becoming a victim by understanding more deeply how scammers manipulate people regardless of their specific scheme.
Criminals use manipulation to induce stress, anxiety, or discomfort so that the victims will make decisions that contravene their best interests. In my teaching, I call this the susceptibility principle. The ransomware hack described earlier that resulted in a man and child’s death deployed this principle. So too do any number of scams that threaten some kind of awful consequence for incompliance. In one especially common scam targeted at the elderly, hackers purporting to be from the Internal Revenue Service call claiming that your Social Security number has been disabled and you won’t be receiving any further checks until it’s reenabled. That, of course, requires payment of a fee. These scammers are sophisticated. They’ll address victims by name and confirm their address and other personal information, using profiles they bought off the dark web. Their victims will hear background noises, as if the scammer is calling from a busy government office, and the call will come from a spoofed, Washington, D.C., area phone number. An elderly person receiving such a call might be so terrified that they’ll pay the fee, dependent as they are on their Social Security check for their monthly expenses.
Spend a half hour watching commercials. Analyze how they use manipulative tactics to obtain their objectives.
Susceptibility can also work via more positive emotions, as in the vacation rental scam described above, or in the attempts of parents to bribe kids to do their homework, or in all those emails, texts, and phone calls that claim you won a prize and just need to click on this link in order to claim it. Another example is the classic “honeypot” technique, in which a manipulator arouses lust in their target to achieve some selfish objective. Television advertising deploys this approach, manipulating viewers to buy by featuring attractive announcers and dressing them in revealing ways. We’ve all heard the adage that “sex sells”—companies peddling fast food, beauty products, alcohol, and lowbrow entertainment routinely feature sexually provocative imagery, hoping to entice viewers.9 Such pitches seem effective for companies selling products that people buy on impulse and that don’t carry much risk. For products that are more complex and expensive, research has found that sexually provocative advertising actually doesn’t work as well. In our era of #MeToo, provocative ads might also be losing their effectiveness for product categories like fast food, where they had formerly delivered for companies.10
Some advertising arouses both positive and negative emotions in the course of delivering their pitch. You’re watching television, and an ad comes on that depicts a starving dog lying in filth. Some sad music comes on and you hear, “Won’t you please give just a few pennies a day to help animals like this?” Then you hear happy music and see pictures of healthy, playful dogs that the organization has saved thanks to generous donations from people like you. Feeling this incredible urge to help that dying dog and transform it into that wonderfully healthy dog, you call the number on your screen and donate. But like sex, this tactic is now proving less effective for a savvy viewership craving authenticity and real-world impact.11 According to some experts, leading with creativity, humor, and emphasizing results—that is, drawing on influence-building techniques instead of emotional manipulation—does more to create sympathy for important charitable causes.12
Deft manipulators increase their odds of success by playing on various aspects of human psychology. Here are four pathways to the susceptibility principle that I encounter all the time and that you should remain mindful of in everyday life:
As researchers have shown, our physical environments exercise a powerful hold on us. The Harvard psychologist Ellen Langer, dubbed the mother of positive psychology, was in the forefront of such academic scholarship.13 In 1981, she conducted a pathbreaking and unprecedented experiment, testing whether germs and genes alone accounted for the aging process, or whether other psychological factors could also exercise an impact. That year, Langer, a young scholar at the time, gathered eight septuagenarians in New Hampshire. Upon entering a converted monastery, these men, suffering the usual aches and pains of advanced age, were transported to the year 1959—more than two decades prior, when they were young and vital. Their clothing, entertainment choices, discussion of current events, and home furnishings all reflected their midcentury youth. They spoke about these historical topics using the present tense and were even treated like younger men, ordered to march their belongings up the stairs by themselves after entering the premises.
After only five days, these men’s biomarkers improved dramatically—miraculously even. Everything from their posture to their eyesight to their impromptu decision to ditch their canes and compete with one another in a touch football match! Unfortunately, this now classic experiment, thereafter known as the “counterclockwise study,” was too expensive, difficult to replicate, and ahead of its time to make much of an impact in academia and popular consciousness. It wasn’t until decades later, after a 2010 collaboration with the BBC, that Langer, by then the coauthor and author of numerous studies, gained broader recognition for her extraordinary contributions to our understanding of the mind/body relationship.14
If Langer’s research suggests how we might organize our environments to benefit ourselves and others, hackers, con men, and others modify environments to compel targets to do their bidding, often to their own detriment. At an extreme, intelligence agencies use environmental control techniques bordering on torture to compel terrorists to divulge information. After terrorists attacked the United States on September 11, 2001, the George W. Bush administration helped inaugurate the enhanced interrogation program, subjecting terror suspects to environmental techniques such as incessant noise, waterboarding, placement in small, dark “confinement boxes,” and sleep deprivation (via forced contortion of the body into painful positions using restraints).15 Such treatment is controversial—some insist torture is barbaric and ineffective, not inspiring targets to divulge sensitive information, while others insist that “torture works” and that authorities should revive even more punishing techniques than enhanced interrogation to combat terrorism.16 At the other end of the emotional spectrum, we have the environmental control techniques deployed at Las Vegas casinos. Not only do these places rob customers of their sense of time; the loud noises and bright lights from the slot machines assault their senses, prefiguring the excitement they’d experience by winning. Free-flowing alcohol provided by casinos and scantily clad hostesses intensify the sensory overload and further suspend customers’ critical-thinking capacity, leaving them inclined to gamble far more than they should.
The social dimensions of our environments often figure prominently in attempts by manipulators to compel our actions. Why do pledges willingly submit to obscene and painful hazing rituals in order to join fraternities? Yes, they’re usually drunk off their rockers, but they’re also operating in an environment in which the social pressure to submit is overwhelming. Picture a room filled with dozens of other rowdy brothers who are also behaving in uninhibited ways. The music is loud, the alcohol is flowing, and no authority figures are around. Other pledges are submitting to hazing, allowing themselves to be beaten and physically abused in ways too gross to mention here. The implication is clear: if you don’t submit like they are, you’re both a loser and out of the frat. In such a circumstance, the individual pledge’s rational faculties are severely undercut, and it’s almost impossible for him not to “go with the flow.” Upon awakening the next day, when he’s done being sick, a pledge will likely be thinking, “How could I possibly have done that?” Simple. His fraternity brothers made him more susceptible to persuasion by using his social context against him.
Another pathway to susceptibility is what is called forced reevaluation, the technique of making people doubt what they have been taught or what they think they know by confronting them with contradictory facts. You might have heard of gaslighting, in which a person prompts a person of interest to doubt not just a particular fact or idea, but their own sanity. That is forced reevaluation taken to an extreme. The experience of contradiction causes tremendous uncertainty: you thought the world worked in a certain way, and all of a sudden you discover that your basic understanding doesn’t hold. That uncertainty in turn leads to anxiety or even panic, which prompts you to behave in ways that might prove counter to your own best interest.
Research has confirmed that the prospect of an uncertain future stresses us out even more than the knowledge of something bad looming ahead. In 1994, a group of Canadian scholars developed the Intolerance of Uncertainty Scale (IUS), demonstrating how an inability to cope with uncertainty represented a “cognitive vulnerability” and was associated with negative outcomes like anxiety or eating disorders.17 But in 2016, scholars published the results of what one journalist has called “the most sophisticated experiment ever conceived on the relationship between uncertainty and stress.”18 Many gamers out there would just love it if their gaming experience became more lifelike and “experiential.” How’s this for experiential: Researchers asked participants to play a video game in which they had to flip over a series of rocks. Sometimes a snake lingered underneath those rocks, and when it did, researchers jolted participants with a powerful electric shock.
Researchers tracked the presence of risk (or “irreducible uncertainty,” as it’s termed in the study), comparing it to the volunteers’ self-reports of stress and physiological indicators like pupil dilation and the presence of sweat.19 You guessed it: stress and uncertainty were positively correlated, with stress levels peaking when uncertainty of a shock reached 50 percent (that is, as close as possible to perfect uncertainty).20 It turns out that the part of the brain associated with dopamine activation goes on high alert when we can’t predict the outcome of an event.21
We don’t need statisticians and brain scientists to tell us that uncertainty is stressful—we’ve all experienced it. Did you ever take a tough exam in high school without preparing very well for it? When you know with certainty that you got a D−, you’ll probably stop worrying (or at least worry less) and instead focus on managing the situation (by getting extra help, say, or thinking of a way to break the news to your parents). But before you find out your grade, you’ll feel more anxious, rehearsing in your mind scenarios in which you sit down triumphantly at the dinner table and tell your parents you managed a B+, or in which you slump down and incur their disappointment by announcing that you failed.22
When a skilled manipulator is prompting you to question your previously strong beliefs (forced reevaluation), the resulting uncertainty can be so strong that to ease the anxiety you feel, you’ll comply with wishes that you ordinarily wouldn’t have. Let’s say it’s a Tuesday night in October, and you think your college-age daughter is safe in her college dorm. Then you get a call informing you that she’s been kidnapped, and the criminals will rape and kill her if you fail to transfer $2,000 in Apple gift cards in the next ten minutes. The image of your daughter being threatened might strike terror in you, but so does the shock of discovering that your daughter is not safe in her dorm as you had assumed, but in some unknown and unsafe place. The apparent revelation forces you to reevaluate everything else you think you know about your daughter, her circumstances, and maybe even life itself. You might suspect that the call is a scam, but in that moment, the prospect of uncertainty is so strong that you don’t quite know what to believe. So rather than chance it, you send the money.
We see forced reevaluation at work in corporate settings. Let’s say you work in IT at a company with very strict rules about disclosing information. If someone calls you and says that the CEO asked you to give out information because there have been two hundred security breaches over the past two days, and some heads are about to roll, you might give out the information, reasoning that the company didn’t really want you to keep to corporate policy about information disclosure in such a dire situation. The contradiction unsettles you—again, you now don’t know what to believe. So rather than risk ticking off the CEO, you give in to your anxiety and make an exception.
Sometimes companies deploy forced reevaluation on their own employees to make them work harder. Rather than simply lay people off, companies will announce months in advance that they will be laying off a certain number of people, without naming who those people are. Think of the impact such a move has on individual workers. Until the announcement, they might have assumed that the company was doing fine and their jobs were secure. Then they hear that the company isn’t fine and layoffs are coming. Even if their own performance has been strong, a seed of doubt is sown in their minds. Something important they thought they knew about the company turns out to be untrue. What else is untrue? With their anxiety rising, they’re going to work harder just in case—quite possibly the company’s intended result in giving advance warning about layoffs.
A third, extremely effective route to susceptibility is to take away a person’s power. People want to feel in control. At some deep, primal level our species has equated control with power, and power with survival.23 And at the heart of control is choice. Human beings and animals alike prefer having choices, even if they won’t improve an outcome.24 As one research study, aptly called “Born to Choose,” put it, “Belief in one’s ability to exert control over the environment and to produce desired results is essential for an individual’s well being.”25 Successful companies understand this, and have extended autonomy to their employees, increasing their productivity, happiness, and performance.26 As Professor Ranjay Gulati of the Harvard Business School has observed, “Leaders know they need to give people room to be their best, to pursue unconventional ideas, and to make smart decisions in the moment. It’s been said so often that it’s a cliché.” In particular, decades of research have shown that employees “want some form of choice and voice in what they do at work, and that this can spark greater commitment and improve performance.”27
If someone can take away your (oftentimes illusory) sense of choice and therefore control, the fear and outright distress you feel might be overwhelming, to the point that you’ll make rash decisions you otherwise wouldn’t. Over time, if your loss of control persists, you might give in simply because you’ve become habituated to it. The result is what Martin Seligman and his colleague Steven F. Maier termed “learned helplessness.”28 In the mid-1960s, Seligman, a graduate student at the University of Pennsylvania, was studying avoidance learning in canines. Seligman and his team applied electric shocks to dogs, who either chose to endure the abuse or escape their fate by scaling a barrier. Following repeated abuse, some of the dogs stopped attempting escape and, dejected, submitted to the torture. The researchers modified the experiments, readministering shocks and offering escape routes to the dogs, but the results were the same: a large subset of the animals remained defeated. Seligman was no monster: he wanted to reverse learned helplessness among humans and canines alike and has devoted the rest of his distinguished career to trying to overcome learned helplessness through learned optimism.
Manipulators will sometimes punish others or levy the threat of punishment to elicit strong emotion (namely, fear or even terror), making their targets more susceptible to persuasion. The most obvious example of this is torture. Studies have shown that torture is stunningly effective at eliciting confessions but terrible at eliciting truthful information. “We’ve Known for 400 Years That Torture Doesn’t Work,” declares an article in Scientific American. Citing inquisitors inflicting torture from the European witch craze, the article demonstrates what we all know to be true intuitively: people will confess to just about anything to stop the pain.29 But belief in the magic of judiciously applied torture persists. In the hit television series 24, Kiefer Sutherland plays the no-nonsense interrogator Jack Bauer, who uses any means necessary to extract intelligence from terrorists and thereby save major metropolitan areas from misery and mayhem. “It’s a Hollywood fantasy,” concludes Scientific American. “In reality, the person in captivity may or may not be a terrorist, may or may not have accurate information about a terrorist attack, and may or may not cough up useful intelligence, particularly if his or her motivation is to terminate the torture.”30
Criminals mobilize the punishment pathway to a lesser but frightful extent through any number of scams, whether it’s ransomware that seals off your computer and demands a payment, or the countless scams that claim you committed a crime and threaten you with imprisonment if you don’t pay a penalty. It was precisely such a threat that led that poor Romanian man to kill himself and his child.
The threat of punishment doesn’t have to be especially severe or dramatic to compel a response. Remember that bank I mentioned earlier that asked us to try manipulation to extract sensitive account information from their employees? We succeeded in that assignment by having one of our female team members call up an account specialist purporting to be an assistant who worked for one of the bank’s customers. The assistant explained that her boss, who was pregnant, was going into labor and yet desperately needed the account information to handle a last-minute work matter. The account specialist asked the usual verification questions to establish the boss’s identity, but every time he did, the boss went into a little bit of labor, moaning and groaning audibly into the phone.
The account specialist was empathetic, but he explained that he simply couldn’t give out the information. Finally, after about twenty-five minutes of buildup, we had the “boss” go into full-blown labor and scream to her assistant: “Don’t you dare hang up that phone until you get that account information. Payroll isn’t going to go out unless you do!” Pretending to be panicked and overwhelmed, the assistant pleaded one last time with the account specialist to give her the sensitive banking information she sought. The guy finally caved. Clearly, he sympathized with the boss and her panicked assistant. The “punishment” we were implicitly threatening was the guilt he’d feel once he’d hung up the phone at not helping these two people in dire need of assistance. Firing up his fear of feeling guilty and the psychic pain that would entail, we got what we wanted.
The four pathways I’ve described often overlap with one another, and we frequently find instances of manipulation that deploy all of them at once to varying degrees. Consider the situation in which a company announces pending layoffs. That move doesn’t merely compel employees to work extra hard because of forced reevaluation, as I discussed. The threat of “punishment” implicit in the layoffs—future job loss and unemployment—also manipulates employees to redouble their efforts. There is as well the increased powerlessness that comes with uncertainty about your professional destiny: some senior leader high up on the executive floor has made a decision that might change everything for you. Aspects of the workplace environment might also change, exacerbating your fears and prompting you to work even harder. At the same time as your company announces future layoffs, they might also cut back on office luxuries and travel. All of a sudden, everyone around you is bringing their own snacks to work and staying late, eager not to be one of the unlucky few to lose their jobs. Sitting at your desk every day and taking this in, it’s easy to see how you might give in to the prevailing fear and work late yourself.
Think of a request you will have to make of someone in the days or weeks ahead. Take a sheet of paper and draw a line down the middle. On one side, jot down some ideas as to how you might use influence tactics to achieve your objectives. On the other side, think about the pathways to susceptibility described here and how those might apply. Commit yourself to taking the higher road and deploying influence. If you’re a parent with children who don’t want to do their homework, what manipulation tactics do you typically use and how might you avoid them while still getting what you want?
Years ago, just after I had put up my shingle as a professional hacker of humans, a very large company hired me to throw everything we had at them—phishing, vishing, attempted break-ins to their physical facilities, you name it. We did, and their security was so good we just couldn’t break through. I was at wit’s end, and at that point I should have stopped and admitted defeat. But instead, I let my ego get the better of me and hatched a plan to manipulate our way in.
A female colleague of mine and I sat down in the company’s cafeteria atrium, which was outdoors, unsecured, and easy to access. We were posing as members of the company’s HR department, and as a pretext we were there to ask employees to fill out information forms regarding their health care policies. The forms contained information we secretly wanted—employees’ full names, date of birth, and employee ID. We could in turn use that information to compromise the company’s computer system.
As per our preset plan, my colleague announced to me that she had failed to meet a deadline I’d given her, I stood up, pushed back her stack of forms, and in a fairly loud voice appeared to blow up at her for screwing up our work project. “You worthless wench,” I said. “No wonder you can’t keep a job. If you don’t get this fixed by tonight, you’re fired.” I stormed off, and two guys who had been sitting nearby and heard the whole thing jumped up to run after me, intending, I thought, to beat me up.
I pretended not to see them, and my colleague stopped them and defended me. “No, no,” she said, “please, guys, please. He’s under a lot of stress. He and his wife are having problems at home. I was supposed to get this project done, and it was all my fault. He had every right to yell at me.” Her voice trailed off as she said this, giving way to tears and slumped shoulders. It was mock Stockholm syndrome.
“No one has a right to yell at you,” one of the men said. “Nobody should treat you this way.”
Another bystander, who appeared to be a senior manager at the company, came over to ask what happened.
“Her boss just yelled at her,” one of the Good Samaritans said. “He’s going to fire her today.”
“Nobody’s getting fired today,” this bystander said. He took the forms and ordered everyone in the cafeteria to fill them out. Within ten minutes, we had seventy forms filled out, with more than enough information to break into the computer system.
Big victory, right? Not at all. We had manipulated our way in. The employees didn’t comply because they wanted to, but because of negative feelings we had aroused. We used the punishment pathway, confronting our targets with the psychically painful prospect of seeing someone else humiliated and fired. To some extent, we used forced reevaluation as well, creating a boss-employee interaction that directly challenged the norms of professional conduct. Our actions left our targets disgusted at what they’d witnessed. They felt bad for my colleague and were angry at me. They didn’t feel better for having met us. They felt worse. No coincidence that the company never called us back to work for them again.
What we should have done, once we had determined that all of our ordinary techniques had failed, was call off the test and congratulate the company on their effective security. We could have then proposed using manipulative techniques such as this, justified for the sake of protecting them against the most unscrupulous plotters, and gotten them to agree to it. Then, and only then, would I have felt good about using such techniques.
This episode, which took place early in my career, represented a lapse of ethics on my part, and one I continue to deeply regret. I’m happy to say, though, that it was a turning point for me. Until then, I had tried to minimize harm to others and do the right thing, but I hadn’t given much thought to the ethical standards I would uphold. I hadn’t asked myself what kind of hacker I really wanted to be—what my purpose was. Was I in it for the money? Or would I dedicate my career to doing good and trying to make a difference in others’ lives? If all I wanted was money, then exploits like this were probably fine—I hadn’t caused that much damage. If I wanted to do good, then with a few exceptions I had to avoid exploits like this, even if I knew they would work.
In the wake of that episode, I reflected on my core beliefs, and I thought a great deal about my kids. If they ever came to work at my company, I wouldn’t want them to see me manipulating people as a daily practice, much less engaging in that behavior themselves. Even if they never did work for me, I wasn’t sure what kind of role model I could be if I routinely treated others around me so callously. Such thoughts proved immensely clarifying. I now knew I wanted to do good. I understood how lousy it felt to win by manipulation, and I wanted to avoid that as much as possible.
I proceeded to fundamentally change everything about how we ran our company—how we designed our exploits, how we trained our team, how we dealt with clients. To keep us focused, we adopted Robin Dreeke’s mantra—“Leave them better off for having met you”—as our “north star.” I also became keenly focused on ethics in my personal life, staying alert to times when I might be inadvertently manipulating and changing or avoiding that behavior. I looked for new ways in which I could use human hacking techniques for good. In 2017, I created a nonprofit, the Innocent Lives Foundation (ILF), that uses hacking techniques to help catch and convict child pornographers. To date, ILF has assisted in over 250 cases. I’m not perfect, but I’ve gotten a whole lot better. My relationships have deepened, and I’ve become happier. You can keep your conduct firmly on the side of light, while also staying attuned enough to manipulation to protect yourself. You’ll be both better off and safer for it, and you’ll still get much more of what you want from people.
To increase the odds that you’ll get more of what you want while avoiding manipulation, I’d like to share some additional techniques that when skillfully deployed can boost the effectiveness of influence techniques. A bit later, I’ll discuss how to get the details of your social interactions right so that you come across as authentic and natural. But first, let’s explore how you can use a basic understanding of body language to dramatically improve your interactions with others. Criminals and professional hackers can quickly and accurately interpret your body language to glean your inner emotional state. They also know how to use their body language to evoke emotions in helpful ways. By becoming more attuned to body language yourself, you can become far more sensitive to what others are experiencing and aware of your own presence, qualities that help you build relationships and induce others to want to help you.