Keep social encounters “real” by fine-tuning your approach.
Even with the most logical pretext, you can still fail in your social interactions because subtle details of your dress, speech, or demeanor render your behavior inauthentic or unbelievable. To maximize your chances of success, keep authenticity foremost in your mind, avoiding a number of key hacking “fails.” A well-told story seems “real” and believable at every turn. Your social encounters should, too.
Not long ago, my team and I traveled to a developing country to break into the headquarters of a large bank. They do things differently over there than we do in the United States. As part of the bank’s security measures, they had burly, tough-looking men with automatic weapons riding around the parking lot on motorbikes. Fortunately, we had human hacking techniques on our side. We discovered that the bank was undergoing a bunch of technical tests to ensure that it complied with international standards. With a bit more probing, we learned which company was conducting the tests and created professional-looking shirts embroidered with the company’s logo. We hired a local to stroll into the headquarters before us and start a conversation with the security guards, saying he had come to do some work, and asking what documentation he would need to bring to gain access.
While that conversation was taking place, a colleague and I were going to walk up wearing the shirts we had made. I would talk on my cell phone, and both of us would carry official-looking clipboards.
I strolled up as planned with the phone to my ear, nodding my head and saying, “Yeah, yeah, I’m coming up now. We’ll complete the test in a second.” We strolled right past security, and they didn’t say a word. Inside the headquarters, we walked around, quickly orienting ourselves. Time was short—we didn’t want to get caught. Spotting a door marked “ATM Testing Center,” we approached it just as a woman was walking in. She unlocked the door with her badge and we followed her in. “Excuse me,” she said,
“Oh, yeah,” we said, “We’re doing a PCI [payment card industry] compliance test.”
“Oh, okay,” she said.
She did what she had come to do, and a minute later left the room. And that was it. Over the next fifteen minutes, we compromised the entire bank.
This job went off so smoothly, despite those guards with automatic weapons, because we had created a suitable pretext for ourselves, as described earlier in the book. But how we executed on that pretext mattered, too. We got the details of our presentation exactly right, tweaking them so they supported our pretext and framed meaning in desirable ways. There were the uniforms and the clipboards, but that was just the beginning. If I had seemed nervous upon approaching security, or if I had spent too much time describing who I was and arguing that I was legit, the guards would have become suspicious. If I didn’t seem like I knew where I was going or that I understood what a testing technician did, or if I had asked security personnel directly where the server room was, they again might have doubted us. Something about us would have seemed off or false.
Understanding these nuances, I took a carefully calibrated, minimalist approach. Rather than speaking more than necessary, I acted like I belonged, talking on the phone, seemingly busy and directed, while the guards were distracted by the local. I did say that I was coming upstairs loud enough for the guards to hear—this suggested that I belonged, as did the fact that I just strolled past security, as if I had done so numerous times before. Having two people instead of one worked to our advantage—it made sense that a company performing extensive testing would send in multiple people. All of these details worked together to create a frame of meaning that said, “These guys are supposed to be here, let them in.” So, the security guards did.
Skillful storytellers attend to the details of their narratives with an eye toward making them consistently believable and natural. Filmmakers and novelists know that a single mistake risks alienating audience members, causing them to become aware of the story’s artifice. In that case, the entire experience loses its magic. To succeed with the human hacking techniques presented in this book, you must adopt the mindset of a storyteller, attending to the details of social interactions with authenticity in mind. You must know your “audience” in sufficient depth and anticipate what will appear real and natural to them as you execute on your pretexts and apply elicitation and general influence techniques.
I’ve touched on authenticity throughout this book, but the subject is so important that we must also address it in a more methodical and focused way. I can’t provide you with a rulebook for rendering your human hacking efforts perfectly natural every time. Social interactions are too complex and varied. What I can do is focus on the biggest mistakes hackers make that prompt their targets to “wake up” and become alert to their cons. Remember these mistakes and steer clear of them, and your efforts to influence others will become far more real, believable, and compelling.
In my experience, five key “fails” account for the vast majority of ill-fated attempts to influence other parties. Committing any of these errors will prompt your person of interest to become alert to your hidden motivations and techniques. They might not understand exactly what your goal is, but they’ll sense that such motives exist and are shaping your behavior. That alone will prompt them to raise their guard, interfering with your efforts to steer the conversation advantageously. People make these mistakes all the time in everyday discourse, breaking the spell they otherwise might have had on others.
“Show, don’t tell” is an old adage in storytelling. The idea is to portray a theme or moral via characters’ actions rather than to have them or the narrator relate the theme overtly. If you’re ploddingly explicit about delivering a message, the audience might recognize it as a message they are intended to consume, and the entire presentation will lose its power. To borrow a term from the linguist George Lakoff, you’ll draw their attention to the “frame” of meaning you’re trying to create. Frames, Lakoff writes, “are mental structures that shape the way we see the world. As a result, they shape the goals we seek, the plans we make, the way we act, and what counts as a good or bad outcome of our actions.”1 But frames often work on us because we aren’t aware of them. We just think we’re seeing reality as it is. When we do perceive a frame, it might still work on us, so long as we don’t sense that it is being used against us or others. When we do perceive a hostile intent, our critical minds go to work and these frames lose their power.
Think back to that example I developed in which you’re trying to get your sister to help you out financially with your elderly mother’s care. As I advised, one way to proceed using influence techniques might be to hold the conversation over dinner at a restaurant you know your sister likes and at a time when she won’t be tired or feel stressed from work. Order your sister’s favorite appetizer or bottle of wine, and then start the conversation by building rapport. Later, when it comes to delivering your pretext, you might say something like: “Listen, I wanted to have dinner with you because I need your help. Mom’s condition is declining. She can’t take care of herself any longer. I’m not quite sure how to handle it. But I value your opinion, so I thought I’d ask what we should do here.”
From there, you might use influence techniques to nudge your sister toward the notion that she should contribute toward your mother’s care. You might deploy social proof, observing that another trusted relative or friend contributed to their mother’s care. Or you might use the liking principle, expressing your esteem for what a great daughter your sister has always been. What you shouldn’t do is say or do anything that makes your sister aware of all you have been doing to influence her. As the waiter serves your sister’s favorite wine, you shouldn’t say, “Oh, look, I ordered your favorite wine.” Later, as the waiter serves the main course, you shouldn’t say, “I know you love that dish. I wanted to eat here because I know it’s your favorite restaurant.” Such seemingly harmless comments risk taking your sister out of the experience and focusing her attention where it doesn’t belong—on you and your possible motives. You’re practically saying to her, “Look, the reason I thought about doing something nice for you was because I wanted you to comply with some request of mine.” Not so smooth.
When I sneak into buildings posing as an elevator repairman, I don’t blurt out to the security guards, “Hey, here’s my repairman outfit, and these are my repair tools. I’m an elevator repairman.” The guards know I’m a repairman from my outfit and the tools I carry. I’m not suggesting you should never openly acknowledge your pretext or actions you’ve taken to influence others’ behavior. Let’s say I’m posing as a repairman from Otis Elevators and wearing a shirt emblazoned with that company’s logo. If the security guard, seeking to make casual conversation, exclaims, “Oh, you work for Otis?” then acknowledging I do becomes a natural part of the conversation. But if the question hasn’t been posed, there’s no logical reason in my target’s mind for me to point out my job description to them. That I’m doing so will prompt the guards to notice and scrutinize me.
Some unsuccessful human hackers are even more cringe-worthy in their ham-handedness. Not content to spell out what they’re doing for their person of interest, they go a step further and pointedly reassure that person that they’re not doing anything nefarious. I’ve heard students trying to sneak into a secure facility hold up their fake ID badge and say: “Look, see? I’m an employee. It says so right here.” And then they say, in what they take to be an offhanded way, “I mean, it’s not like I’m a hacker or something.”
What?? Don’t say that! A competent narrator of a story interested in making a point, say, about the meaninglessness of life would never blurt out: “It’s not like I fabricated this whole story just to convince you that life has no meaning.” Such a move would blow up any authenticity the narrator had managed to establish. As Lakoff has famously observed in the context of political discourse, “when we negate a frame, we evoke the frame.”2 The very words we use in negating an idea perpetuate that idea by bringing it to others’ minds.
If you were to remark to your sister, “It’s not like I asked you to dinner tonight just to hit you up for money for Mom,” what is she more likely to think? The idea that you might have an agenda of your own might never have occurred to her. But now you’ve planted the seed of an idea. That seed might sprout during your conversation and grow into a nasty weed of skepticism and doubt—the very opposite of what you intended. Don’t ever negate the “frame” or narrative you’re creating via your pretexting and rapport-building efforts and your mobilization of influence techniques. Not even a little bit.
Any story you might tell requires details. Otherwise it seems vague, overly abstract, meaningless. Moreover, you have to reinforce the frame of meaning when delivering a pretext by offering multiple, affirming details. When I pose as a pest control guy, I have the uniform, the spray canisters, and a clipboard with a fake work order on it all working together to establish that my pretext is legitimate. But that’s enough. I don’t then have to go on to give the security guards a lecture about the insects I’m there to spray for, nor do I divulge the particular pesticide I’m using, nor do I tell them how many other facilities I’ve sprayed that week. Pile on too many details in an attempt to be “perfect,” and I’ll leave my target thinking about all these details and how many there are. They’ll become aware of the story as a story they are meant to consume and believe it less. I’m liable to come off seeming anxious, jittery—and potentially fake.
When my team and I broke into the bank mentioned above, we marshaled a number of relevant details. I knew what my purported name was, our company’s name, why we were there, what a compliance test was, what parts of the bank were being tested. But I didn’t walk into that bank and announce that my manager, a man named Rafik Ghalili from our Chicago office, had told me during a meeting we held on June 17 to come to this country to finish a PCI compliance test, which was performed initially on September 13. I didn’t inform the guards that I’d been doing compliance tests for my company for the past six and a half years and that I received my training at our Baltimore, Maryland, facility. Nobody cares about all that detail. That I had somehow felt inclined to spout all of it would have seemed odd to the guards.
Hackers often don’t deliver too many details but rather make the few they do deliver too extreme. Sometimes they tell lies in an effort to produce the “perfect,” killer detail that will win over a target. I recently scheduled a meeting with a business associate who knew that my favorite band was the rock-and-roll band Clutch. When this associate, who didn’t know me well, picked me up in his car to head to the meeting, he had a Clutch album that he’d downloaded playing in an effort to build rapport with me. When I remarked on the choice of music, he said, “Oh, yeah, I heard you talking the other day about how much you loved them, so I thought I’d download an album and put it on for you.”
My associate didn’t claim to have become a rabid fan of Clutch overnight, nor did he purport to know every last song or album the band had released. If he had, I might have wondered about his truthfulness, as nothing he had said or done indicated that he had any particular affinity for Clutch or their style of music. If I had gone on to inquire casually what his favorite song was on the album we were listening to, or if I had asked some other follow-up question that required knowledge of the band to answer, he might have reacted awkwardly, scrambling for what to say. In his effort to lend authenticity to his rapport building, he’d have eroded it.
If you’re inclined to try to make a social interaction “perfect,” bear in mind an observation that the Roman emperor Marcus Aurelius made thousands of years ago. “When bread is baked,” he said, “some parts are split at the surface, and these . . . have a certain fashion contrary to the purpose of the baker’s art, are beautiful . . . and in a peculiar way excite a desire for eating.”3 Most of us value imperfection. We find it not only beautiful and enticing, but also desirably authentic—what one researcher has spoken of as “aspirational realness.”4 This holds true when it comes to bread and many other consumer goods, and it holds true for social interactions as well. So, don’t feel compelled to get everything about your presentation absolutely right. An ethic of “good enough” works best.
Unsuccessful hackers don’t simply take details too far. They get details wrong, speaking or acting in ways that distract from their pretext or even contradict it. If your pretext has you playing the role of a kind or compassionate sibling, say, or of the dignified, respectable authority figure, or of the upstanding professional, and you drop multiple f-bombs in the course of conversation, your pretext will seem less believable. This is a huge problem in my industry. Since social engineering is traditionally male dominated, many operators unthinkingly use horrifically sexist language. You’ll often hear security professionals who had succeeded in breaking into a company’s computer system say, “I just raped that server!” What kind of image does that convey? If you’re trying to influence others yet you speak like a jackass, you can expect failure. Likewise, if you’re a newlywed trying to forge a relationship with your spouse’s family, none of whom are native English speakers, and you load down your conversation with fancy English words that your spouse’s relatives are unlikely to understand, like “confabulated” or “irascible,” you probably won’t make much headway in your pretext of being “the welcoming and accommodating new family member.”
Besides language, other aspects of your presentation might wind up offending your person of interest if you’re not careful. As we saw in the last chapter, our body language sends subtle cues to others. If I’m a large-bodied male trying to interact with a woman who is physically much smaller than me, and my hips are facing square in her direction, she might subconsciously perceive that as threatening. If I’m a male of any size trying to build rapport with a new female student who is wearing a hijab, and I offer a handshake, I might also inadvertently cause offense, since strict Islamic cultures forbid any touching between strangers of different genders. If I’m addressing an elderly person who is hard of hearing and I speak quickly and softly, I might unintentionally put that person in an uncomfortable position, compromising my efforts to influence them, especially if I were playing the attentive and compassionate grandson/neighbor/friend. If I’m playing the role of the attentive father and I’m constantly glancing at my phone while my son or daughter is speaking, I again compromise my authenticity. My efforts to exert influence will suffer.
We must consider, too, our general appearance and how it might come across to others, particularly strangers who don’t know us and who have only stereotypical impressions of us to go on. If I’m a tall, bald male, many people will perceive me as angry or aggressive. I could be the world’s sweetest, most empathetic person, but that’s the stereotype. When attempting to influence others, I must bear that stereotype in mind and correct for it in my speech and behavior, perhaps by going out of my way to smile warmly and speak softly or by giving my person of interest the chair at the table that sits a bit higher (thus putting them in a position of authority or power). Similarly, if I’m a buxom female trying to influence a roomful of men, I should think about how long my sleeves are, how low my blouse is cut, and similar elements of my presentation, and what my audience might infer, rightly or wrongly, about my motives. No matter my gender, I should bear in mind the socioeconomic dimensions of my presentation. If I’m wealthy but interacting with someone of limited means, will my Gucci bag or Rolex watch support my rapport building or will it cause others to regard me as a snob?
We might dislike the stereotypes people deploy and the biased judgments they make about categories of people—I know I do. But we can’t ignore others’ perceptions, as flawed and hurtful as they might be, and hope to influence these individuals. Week in and week out, I play on these biases in order to induce people to click on a link or admit past a security barrier. I detest these stereotypes, but they’re real and deeply entrenched. To a critic who would fault me for playing on these unfortunate stereotypes rather than challenging them at every turn, I’d point out that criminals don’t hesitate to exploit biases people have, and since my job is to help organizations improve security and make society safer, I have to as well.
Nonprofessionals can’t afford to simply steamroll over those perceptions, either. Some might argue that we should call out our friends, relatives, and neighbors on their biases in an effort to bring about change. At times, that might be necessary. As I’ve said throughout this book, it’s important not to compromise our deeply felt moral principles when interacting with others. But most of the time, if our goal is to influence others, we’re better off showing a bit more humility, meeting people where they are to the extent we can. We can’t change the way the world thinks in our everyday interactions. What we can do is change the way the next person we interact with thinks. The best way of accomplishing that is by making that person feel as comfortable as possible and then leaving them better off for having met us, in the process potentially challenging stereotypes about us they might have had. We also have to accept that some pretexts might not work for us because of others’ racist, sexist, or ageist biases. Elements of our appearance might clash too strongly with the meaning we’re trying to evoke in others’ minds.
“Last night, when I was getting ready to turn out the lights at my office and go home, I noticed that in the corner of my office a bug was hanging from a thread and wrapping another insect in a web.” As you read that sentence, what image pops to mind? Most likely, you thought of a spider. I didn’t have to actually use the word “spider” to evoke that particular insect.
Whenever you have a frame of meaning, words or objects defined within the frame (the web, an insect being wrapped up) evoke the frame (the idea of a spider doing its work in the corner of a room). This principle explains why we don’t need to be overly explicit in our hacking efforts (Hacking Fail #1). Just one or two elements of a frame suffice to do the work for us. But as a corollary of this principle, we also don’t need to ask directly for what we want. Moreover, being too overt about our requests can backfire by causing others to become alert to the frame of meaning we seek to create.
Let’s say my neighbor—I’ll call her Barb—has a big golden retriever who barks incessantly and loudly when Barb lets her out in the morning and evening. This barking occurs as early as six in the morning, jarring my two small children awake at least an hour before their usual wake-up time. I want Barb to wait until at least 8:00 a.m. to let her dog out, or to make some alternate arrangement so our family isn’t disturbed. If I approach Barb in her driveway one evening as she is stepping out of her car and ask her point-blank not to let her dog out until eight o’clock, she might react defensively, especially if she is tired and stressed after a long day’s work. If I’m trying to play the role of the “friendly neighbor asking for help,” my boldness will possibly clash with and undermine that pretext.
A better solution is to approach Barb on a Sunday morning when I’m out for a walk and she’s relaxed and puttering around her garden with her dog, Max, sunning himself by her side. Even then, directly asking her to keep Max quiet in the early mornings might not help my case. As an alternative, I can approach Barb and say, “I love these new rosebushes you put in—they’re beautiful. Max looks like he loves them, too. Hey, while I’m thinking of it, I wonder if you could help me out with a problem I’ve been having. We’ve been talking and we’re not sure what to do about our kids. They keep waking up early in the morning because they hear Max barking. We’ve tried keeping the windows closed, but it’s not working. I know Max has to go out, but what do you think we could do about this?”
This kind of query might start a conversation that would lead Barb to offer to wait until 8:00 a.m. to let Max out, or to come up with some other solution, such as taking him for a walk early instead of letting him out so that if he barks the kids wouldn’t hear him. In that case, I would have gotten exactly what I wanted without asking her directly. Of course, she might not offer anything but instead say something like, “I’m sorry to hear that. Maybe you could put on a sound machine near their room to muffle the barking.” That reaction might cause me to become frustrated at her apparent selfishness. Rather than blow my top, my best move is to try again, saying something like: “No, the kids don’t like sound machines—we tried that about a year ago when the youngest was just born. Is there anything else we might do?”
If at this point Barb offers up your desired solution, great. I’ve been patient in my attempts to influence her, I’ve maintained my pretext in a believable way, and it has paid off. If she hasn’t come forth with the solution, and if after another iteration this situation remains unchanged, then at that point I might decide to ask her directly to keep her dogs in until 8:00 a.m. No pretext is guaranteed to work, but at least I’ll know that I’ve pushed mine as far as it could go, keeping it real and believable in my neighbor’s eyes.
If I do have to ask her directly, I will try to do so without accusing her of anything or casting judgment. A huge difference exists between a stern statement like “Barb, listen, I tried to be a good neighbor and ask nicely, but I need you to understand that you and your noisy dog are irritating and if you don’t keep it inside till eight a.m. I am calling the pound,” and a more sensitive request like “Barb, I know we have gone back and forth on some ideas to try, but I just have to ask if you can keep Max in till eight o’clock. Saturday is the only day of the week I get to sleep in and it would help me and my mental health. Can you please help me out here?” Keep in mind, I don’t know why she is behaving inconsiderately toward me. Maybe she’s being selfish, but maybe she has other, more legitimate reasons. My goal at all times is to leave her better off for having met me while also meeting my desires. Lashing out probably won’t lead me to that result.
Think about an interaction you recently had with someone that didn’t go as well as you would have liked. Analyze your execution of the conversation. How did you begin? How did you build rapport? How did you lay out your pretext? What was your body language like? How were you dressed? Did you consider your person of interest and how they might perceive you? Think of three or four details in your speech or behavior that you might have done differently and try these modifications in your next, similar encounter.
Stepping back from these five “fails,” we find that unsuccessful hackers commit them because of a poorly calibrated relationship with their targets. These would-be hackers either spend too little time trying to understand the people they’re trying to influence, or too much. They ignore their targets and take their perspectives, emotions, and needs for granted, or they become overly obsessed with how their targets might perceive them. Either of these imbalances lead hackers to deliver the wrong details, become too plodding or direct, present too many details, or even tell outright lies in an attempt to “nail down” the pretext and control their targets’ perception. It isn’t just novice hackers who fail to think about their targets in a balanced way. Novices might underestimate the level of understanding they’ll need to be successful and then go overboard in a misguided and misinformed effort to control the situation. But seasoned pros might also take any previous success they’ve had for granted, wrongly assuming their current targets will resemble previous ones, and that what worked before will work again. If these pros are conscientious C-types, they might be further inclined to overplan and strive for a “perfect” interaction.
Although I’m not a “C,” I’ve been guilty of overconfidence at times. Several years ago, we phished a manufacturing company with large government and military contracts. At the time, foreign governments were beginning to use LinkedIn to recruit spies and obtain privileged information. Posing as an attractive young woman, we sent an email to all 7,500 employees at this company inviting them to join a special LinkedIn group. We wanted as many employees as possible to click on the link; doing so would allow us to compromise their computers.
When we first started phishing at the company, about 50 to 60 percent of targets fell for a given exploit. After about eighteen months of working with this company, employees were getting better at recognizing phishing emails—our hit rate was down to about 25 to 40 percent. And yet, this LinkedIn exploit was a rocking success: 79 percent of employees clicked to join the group.
For someone in my business, that kind of success is thrilling. And it went to my head. A few months later, a second company—a big retailer with 10,000 employees—hired us to phish them. “We really need you guys to blow it out of the water with your first phish,” our new client said.
“No problem,” I said, “we’ve got just the thing.”
We used the same exploit that had worked so well for us at the manufacturing company. On the day we sent it out, I eagerly awaited the results. To my shock, barely 1 percent of employees fell for our exploit within the first twenty-four hours. By the end of day two, only 2 percent had. By the end of day three, still 2 percent. By the end of the week, only about 7 percent of employees had clicked—nowhere near the 79 percent at the other company. What was going on here?
I suspected the company’s spam filters might have picked out our email, but we checked and that wasn’t it. We also checked for technical problems that might have prevented many employees from getting the email. Nothing.
Disheartened, I ended the phish and asked our client to have managers inside the company connect with employees who had received the email and inquire why they hadn’t clicked on it. As it turned out, employees at this company weren’t interested in LinkedIn. At the manufacturing company, the workforce had been composed largely of men in their forties and fifties. These employees loved LinkedIn and used it all the time. As males sitting around in their cubicles all day, many of them also had a weakness for a message from an attractive woman. At this retailer, most employees were in their twenties and thirties, and a much higher percentage were women. This generation of employees saw LinkedIn as a site for “old people,” preferring instead networks like Snapchat or Instagram. When they encountered an email offering a LinkedIn invitation, they didn’t pay it much attention. The females among these employees were also less inclined to click on an invitation just because it came from an attractive woman.
We had failed because I, in my great wisdom and experience (insert sarcastic laugh here), had taken my audience for granted. By thinking about how great our previous email was, I had neglected to study our present targets. The basic knowledge I had about these targets—employees at a large company working in a corporate environment—was enough for me to know that the same pretext I had used earlier—a friendly invitation to take an action related to social media—would likely work. But it wasn’t enough for me to get the details of the pretext right. For that, I would look more closely at these targets and develop a clearer (albeit still fairly superficial) sense of their basic character traits, preferences, needs, and so on. I would have adjusted our execution of the pretext accordingly, sending out an email related to activity on Facebook and asking targets to click. Three months later, we got a second chance and sent out precisely such an email. This time, our click ratio was huge.
Try not to take your people of interest for granted. Maintain a healthy focus on them, listening carefully to what they’re saying and trying your best to understand them. But don’t go overboard in your attempts to control the situation. Stay calm, check whatever inner control-freak impulses you might have, and try to be as truthful as possible. It’s very difficult to appear authentic while telling lies. The more your deviate from the truth, the more mental work you have to do. You must now remember all of your falsehoods as an encounter or a relationship proceeds so that you don’t contradict yourself. Even if you manage to pull that off, you’ll likely come across as awkward or stilted in your presentation. Something won’t seem right.
When practicing rapport building, one student of mine tried to build common ground with strangers by asking them where they were from and then always claiming to be from these same hometowns. The initial recognition of apparent common ground created a burst of excitement in the targets, but that quickly faded as they realized that this student knew nothing about their hometown and was quite likely lying. Don’t let that be you. The best nonprofessional hackers I know of not only understand the people they’re trying to influence but also care about and respect them enough not to lie to them. They get more of what they want, and since they leave people better off, they come away from their hacking encounters feeling great.
As you practice the techniques described in previous chapters, keep the five big fails foremost in your mind, as well as the general precepts of knowing your audience, keeping calm, and remaining truthful. If you’ve been working hard all along to think less about yourself and more about others, redouble those efforts. Do you really know your persons of interest as well as you think? Challenge yourself to learn three or four details about them you didn’t know before—what they like or dislike, what challenges they’re grappling with, what elements of their background might frame how they’re seeing the world, and so on.
Polishing your interactions with an eye toward authenticity is about developing a more refined command of the social graces. If you mind the details, your conversations become smoother, more natural, more compelling, and frankly, just easier. Over time, the important relationships in your life take on a different tenor, becoming less frustrating, more loving, and more fulfilling.
Let’s say your significant other comes home after a long day. They’re tired and stressed and their body just hurts. They plop down on the couch, heave a big sigh, and flip on the TV. You approach them with a problem or issue you need to solve, one that involves them. “Listen,” you say, “you left all of your clothes around the bathroom again, and you used up all of the toilet paper and didn’t put a new roll on the dispenser. What’s wrong with you? I work hard all day long like you do, and I can remember these kinds of things. Have a little consideration.” Yours could be the most legitimate gripe in the world, but because you raised it so aggressively and with no thought of your significant other’s mind frame at this particular moment, they’re not going to receive it well. If you persist, they might blow their top. Nothing will get resolved. Your relationship will only be more difficult than it was. Over time, a series of such interactions will impoverish your relationship, locking you into unhelpful patterns of behavior.
Imagine, by contrast, that you waited fifteen minutes or so until your significant other had time to relax. When you did approach them, imagine that you touched them affectionately and handed them their favorite glass of iced tea. “Wow,” you say, “it looks like you had a rough day. You didn’t even say hi when you came in. Is everything okay?” When your significant other describes how rough their day is, you say. “That sounds hard. Listen, when you’re done chilling, can you let me know? I’ve got a couple of things I need to speak with you about.” Maybe your significant other offers to discuss it now. “No, no,” you say with a reassuring smile, “take a few minutes.” When you do have the conversation, you might not get what you want—more respect on the part of your significant other, in the form of better efforts on their part to keep the bathroom tidy. But you’re far more likely to achieve that outcome.
Of course, what you really want to do at this moment is tell your significant other how ticked off you are. But that’s not going to get you closer to your goal, which is to have your significant other keep the bathroom in better shape. So you adopt the pretext of “caring and attentive spouse and partner.” Further, you mind the details. That glass of iced tea is a small gesture on your part, but it validates your significant other, saying to them, “I know what you like and care about you enough to give it to you.” You don’t say, “Hey, look, I’m giving you your favorite drink.” You just give that small gift. You don’t say, “Look, I’m giving you an affectionate little rub on your shoulder because I care about you,” or, “Look, I’m giving you time to relax before I rip into you”—you just do those things. You don’t go overboard trying to build rapport in this situation, popping open a two-hundred-dollar bottle of wine instead of handing over the iced tea, or lying and saying, “I’ve been thinking all day how much I love you.” Those and similar actions would be ridiculous. Reorienting yourself away from your needs and desires and thinking about your significant other’s frame of mind, you execute your pretext in a simple, kind, and informed way. Even if you aren’t successful this time, you haven’t damaged your relationship. Chances are, you’ve done just a little bit to improve its quality even as you’ve made your wishes known.
This example is somewhat trivial, but applying human hacking techniques and getting the details right can make a huge difference when it really counts. One student of mine, Conrad, took my course to help him in his job as a consultant and spent several months practicing the techniques in this book. One day, he picked up the phone to learn that his father had been diagnosed with untreatable, late-stage lung cancer that had spread throughout his body. He had only months to live. His father was in great pain, and the local hospital where he had gone for diagnosis didn’t seem to know how best to treat him. Conrad wanted to take him to a much better hospital in a different city. He arranged to pick his father up and drive him a few hours to the new hospital. Meanwhile, his father’s doctors would make some calls and refer his case so that the new hospital would be ready for him.
Upon their arrival, Conrad discovered that his father’s doctors hadn’t made the promised calls, the hospital had no available inpatient rooms, and a long line of patients were waiting for rooms. Staff told Conrad that there was no way they could help his father, but if he wanted he could go directly to the pulmonology division that treated lung cancer patients and talk directly to one of the doctors there to see if she could help. Conrad did exactly that. Although he was deeply distraught about his father’s situation, he thought back to human hacking techniques and how he might be able to apply them. And he thought specifically about how he might be able to construct a frame of meaning with the right details to help him exert influence.
“I didn’t know this particular doctor,” Conrad remembered, “but I reflected that doctors in general are part of a ‘tribe.’ As a group, they have a seriousness about them. They value intelligence. They value knowledge. They care deeply about their mission as professionals. Therefore, to maximize my effectiveness, I decided to present myself not as a doctor—because I’m not one—but as someone who values these same things.” This meant he would have to dress nicely and use language befitting a well-educated person. He’d have to get to the point quickly, mindful that doctors are often overworked, stressed, and in a hurry. More subtly, he’d have to appear pleasant, respectful, and focused. He’d have to stick to the facts, remaining logical and concrete about his father’s situation and what he, Conrad, wanted. He’d also have to be authentic. As Conrad noted, “I wasn’t pretending in evoking these traits, but rather just bringing out these parts of who I am.” As long as Conrad did that, listening and empathizing with the doctor, not pushing too hard and avoiding the five authenticity fails, he’d do okay.
The conversation went well. At first, Conrad greeted the doctor politely and gave her a brief synopsis of his father’s story and desperate need for treatment at the hospital. He gave her a logical timeline that she could understand. Paying attention to the doctor’s responses, he mirrored her speech and body language so as to build rapport. Without becoming emotional, he evoked his own fear and that of his father, speaking frankly but in a dignified way. When the doctor confirmed that they had no available beds, he nodded that he understood and politely asked her, “So, what can we do about this situation?” Conrad perceived that he and the doctor had established common ground, were making similar gestures, and using a common vocabulary, so it seemed reasonable at this point to pose his father’s problem as a joint problem that he and the doctor could work out together. Conrad offered a suggestion: “Maybe, since we don’t have any spare beds, we could put him in a hallway, and he could stay there and receive treatment until a bed opens up.” The doctor thought about this, and to Conrad’s great relief, agreed. In a conversation that lasted only about forty minutes, Conrad had cut through the usual bureaucracy and handled the seemingly insurmountable challenge of assuring his father’s treatment at this busy hospital.
Conrad’s father stayed at this hospital for several months before succumbing to his illness. During that time, Conrad spoke frequently with the medical staff, taking the same thoughtful and polished approach as he’d taken with this first doctor, and also using body language to his advantage (calm expressions, open gestures, open hands, hips directed at the person if they were facing him). “Every time I approached a doctor or nurse,” Conrad noted, “I made my very best effort to leave this person better off for having met me.” Conrad couldn’t be sure, but he believed his awareness of human hacking techniques and his determination to attend to the details of his presentation made a difference. He noticed that his father was receiving better care than the other patients. He suspected that the medical staff were reacting well to his behavior with them, which was at once finely tuned, respectful, and authentic. In this high-pressure context, where patients and their families commonly show frustration and other negative emotions, the medical staff seemed to notice Conrad’s efforts to interact with them on their terms. As grief-stricken as he was by his father’s passing, Conrad could take comfort in knowing that his father had received excellent care in his final days, and that he, Conrad, had done everything in his power to make it happen.
Conrad’s story suggests the power we can wield when mustering the full array of social engineering principles and techniques. By this point in the book, you’re well on your way to wielding this power, too. You do have to practice the specific techniques—and practice them some more. Depending on your diligence and focus, it could take you a few months, or a few years, but if you stick with it, you’ll see a profound difference. As you handle spontaneous encounters, you’ll have not only a new awareness of what you and others are doing but also the sense of confidence and calm that such awareness provides. You won’t be perfect every time—surprises can and will occur—but you’ll be better at turning those surprises to your advantage. You’ll also be in a better position to handle encounters that you can foresee and for which you can prepare. To round out the book, let’s bring together the techniques we’ve encountered and examine how Conrad might have gone about preparing for his important conversation with the pulmonology specialist. Many people become nervous before job interviews, high-stakes sales calls, legal proceedings, important “relationship” talks, and other planned social encounters. If you apply human hacking principles systematically before an encounter, you can focus yourself, minimize your jitters, and increase the odds of a successful outcome.