SOCIAL ENGINEERING SECRETS
In a small town in northern England, a young girl and her friends were treated to bumper car rides and ice cream after school by a group of teenage boys. Eventually, these boys went away, and the girls began receiving attention from older men. The free ice cream was replaced by rides in cars, vodka, and marijuana. One young girl started receiving attention from a man twice her age, who appeared to be the leader of his group of men. She told the New York Times that he “flattered her” and he eventually bought her drinks and a mobile phone. She liked him. Eventually, after winning her trust, he started raping her. The rapes began gradually, and soon went from weekly to daily. This young victim was then expected to service half a dozen men while locked in the room of an apartment. Unfortunately, this young woman’s experience was not unique. It has been estimated that 1,400 children were sexually exploited in Rotherham, England, between 1997 and 2013. The process was the same. Young men would frequent public places like bus stations, shopping malls, and town centers looking for young girls. They would gradually win the girls over with cigarettes and alcohol. Harder drugs were sometimes introduced. One man would begin a sexual relationship with a girl, and he would act as her “boyfriend.” The boyfriend would then insist that if the girl really loved him, she would also have sex with other men. At this point, threats and blackmail would be used. One young girl was informed that if she told, her family would be killed. In some cases things got even worse, as some girls were bartered or sold for drugs and guns.
This is a tragic example of how social engineering can be used to manipulate people into doing horrible things they would normally never imagine doing. It seemed innocent enough at first, an ice cream cone from a teenage boy at an arcade—but slowly and gradually a much more sinister plan was revealed, escalating into drugs and alcohol, rides and phones, and eventually exploitation by much older men.
At its most basic, social engineering is when a person is psychologically manipulated into taking an action they don’t want to take. Social engineering could also involve manipulating someone into giving away confidential information. Social engineering takes many forms, and thankfully, not all of them are as dark. In New York City and other major cities, you can be sitting at a stoplight when a guy comes up to your car and starts spraying your windshield. You’ll tell him, “Knock it off. I don’t want my windshield cleaned—go away.” But he ignores you and just keeps cleaning. Turns out, he did a great job, and when he comes up to the window you think, “OK, he did clean my windshield, I’ll give him two bucks.” That window washer has socially engineered you into giving him money. Back in Baltimore, there was a homeless man at the front door of a gas station I used to go to. He’d open the door for me and say “Have a nice day.” On the way out he’d open the door for you again, but this time he’d also say “Can you spare a dollar?” I saw lots of people being socially engineered out of dollars by this guy. And is there a single person out there who hasn’t received a birthday gift from someone, and thought to yourself, “Now I have to get something for Jim on his birthday.” These forms of social engineering are annoying, but not necessarily dangerous. Many criminals, however, have mastered social engineering as a way of getting what they want from innocent people.
While social engineering takes many forms, you may be most familiar with social engineering scams that take place online. For example, many of us have gotten the sob story email from an acquaintance. They’re traveling abroad. They’ve been mugged. They have no passport or credit cards. The embassy is closed, they are completely stranded, and have no other option but to email you out of desperation for your credit card number. Thankfully, most of us recognize this for what it is, a scam. Unfortunately, the scam keeps happening, because there is always someone who is willing to give out a credit card number to help a person in need. It’s important to know that social engineering schemes have been happening for centuries, and you’re not just vulnerable when you sit down at your computer. From the Trojan Horse to Bernie Madoff’s Ponzi scheme, social engineering scams take many forms.
I was once traveling with a friend in France who decided to open up her map the second she got out of the metro. Immediately she was approached by a man offering to help with directions. I knew he was positioning her so that an accomplice working with him could steal her purse. Sure enough, there was another man farther back, waiting to swoop in while the man “helped” give her directions. While this is a classic distraction scam, social engineering scams can get very creative. In New York City, a well-dressed twenty-something man was on his way to meet a colleague when he bumped into a man with a young child. When they collided, a container of Chinese food spilled to the ground. The man carrying the food became incredibly angry. “That’s our dinner! You’ve ruined our dinner! I don’t have any more money to feed my kid.” While this lifelong New Yorker was suspicious, he still reached into his wallet to get cash for this guy. He knew it was probably a scam, but didn’t want to risk a little kid going without dinner. Turns out, scam artists buy the cheapest dish on the menu at a local Chinese takeout joint, bump into a sympathetic looking person, and make a nice profit off of their “ruined dinner.” This scam has been updated to include an expensive bottle of wine. Tourists will collide with someone carrying an expensive bottle of wine, be shown a phony receipt to prove it, and asked to fork over $60. The Beijing tea con debuted during the 2008 summer Olympics. Young Chinese girls would befriend a tourist over a period of several hours. At that point, they would suggest that the tourist experience a traditional tea ceremony. The tourist is taken to a teahouse and is not shown a menu. After sampling a small amount of tea during a “traditional ceremony,” the tourist is then given a massive bill. Not wanting to appear rude or foolish, the tourist pays the bill in full. It turns out that the girls are working for the proprietor of the teahouse, and he’s just managed to turn a hefty profit.
All of these situations involved psychological manipulation—preying on individuals’ emotions to entice them to do something they didn’t want to do. Fortunately, you can learn to tune in to situations where your decency as a human is being turned against you. The good news is that by understanding some of the underlying causes that allow humans to be scammed and being aware of some common, basic tactics used by criminals, you’ll never fall for any of their schemes.
The goal of people executing social engineering techniques is to essentially manipulate us through a crack in our thinking. Con artists are experts at finding human faults and using such weaknesses to do whatever they want. Con artists know how to use a wide range of human emotions in their favor—greed, curiosity, generosity, and fear. While emotions like fear can get us out of trouble, like by telling us to run if we’re being chased or to escape if a building is on fire, these feelings can also be used to trap us. What happens in a social engineering scheme is that people fall prey not only to the con artist but to their own cognitive biases as well.
Cognitive biases are basically errors in our thinking that occur while we’re trying to process information. Humans need to sort through lots of information, sometimes quickly, to make a decision. Our cognitive biases are a shortcut our brains take to help us get there faster. These shortcuts are extremely helpful in the situations I mentioned previously—when facing danger. Our biases are less helpful when someone is trying to scam us. There are many different kinds of biases that impact our decision making, but if you learn to be aware of just a few key biases, you’ll be less likely to fall victim to a scam.
Affect heuristic is what’s happening when you’re having an immediate gut reaction. It’s a fast, instantaneous reaction that uses your emotional responses to help you make a decision. The general idea is that if you feel good about something, you’ll assume whatever it is you’re feeling good about will have a beneficial impact on your life. Basically, the way you feel colors how you will interpret a particular situation.
What it looks like: If you grew up spending summers having a great time swimming in a lake with your family, the sight of water will have a pleasant, calming effect on you. If you nearly drowned as a child, the sight of water may make you immediately anxious and afraid. Your feelings about water directly impact your reaction to the actual water.
The decoy effect is what happens when you’re trying to make a decision between two things and then you discover there’s a third option. The third option becomes a way to easily measure the other options against each other. Joe Huber, a marketing professor at Duke University, explained how the decoy effect works by asking a group of people about restaurant preferences. In one scenario, the really great five-star restaurant was a long drive away. The nearby choice was just three stars. The group couldn’t decide. Great food and a long ride? Or dinner nearby—but maybe not as good. They felt the five-star would be a no-brainer if it weren’t so far away. He introduced a third choice, a two-star restaurant located somewhere between the two other restaurants. This led people to choose the three-star restaurant, because it now beat out the third choice on both location and quality.
What it looks like: Not too long ago, we had three simple choices when buying a beverage at a restaurant or a coffee at Dunkin’ Donuts or Starbucks—small, medium, and large. With the introduction of super-sizing and tall, many of us, given the additional choice, go for medium when we normally would have gone for small. The decoy effect is causing our brains to weigh the other choices against the new options, and go for the slightly bigger cup.
People tend to want lots of information, when it’s good news. If the information is negative, even if it’s helpful, people often opt not to know. As you may have guessed, the ostrich effect refers to a refusal to acknowledge negative information by putting your head in the sand. The general idea is that, “If I can’t see it, it doesn’t exist.”
What it looks like: A typical example of the ostrich effect is not wanting to open your credit card bill after an expensive vacation or a big holiday like Christmas. You know the information is likely to make you unhappy, so you simply don’t open the bill until you absolutely have to. You’re avoiding any potentially negative feelings by not letting yourself have access to the information.
While humans need to feel hopeful to make progress, we have a tendency to be more optimistic than realistic. People tend to expect things to turn out much better than they actually do. This tendency to see our future in a positive light means we aren’t preparing for potential dangers and are left vulnerable.
What it looks like: A person who is overly optimistic about the future may not be able to prepare for some life events that are, in fact, entirely possible. Such a person may not save money to have a cushion in the event of a job loss. Or an overly optimistic viewpoint may make that trip to the doctor for an annual physical seem unnecessary. Not saving money or seeing medical professionals on a regular basis can of course have very negative if not disastrous results.
Recency bias is our tendency to think that what’s happening lately—any trends or patterns that we see now—is likely to continue into the future. It’s easier for humans to remember the impact of recent events. So rather than relying on actual data or realizing that there are some events that can’t be predicted, we go ahead with the assumption that life will continue along similar lines.
What it looks like: Recency bias could mean not taking a hurricane warning seriously and refusing to take appropriate measures because your area has never seen a hurricane before.
While there are even more cognitive biases than the common ones I’ve just described, there are a few things you can do to make sure cognitive biases won’t get you scammed. Having a healthy sense of skepticism can keep you safe. I’m not saying you need to be worried 24/7 about getting scammed, but be aware. If someone asks to help you read a map in a foreign country, take a minute to look over your shoulder and make sure you’re safe. If someone shows up at your door saying they’re the police, you need to call 911 to verify that it’s true. Be cautious and don’t be afraid to check your surroundings or verify information to ensure your safety.
We’ve all heard the phrase “There’s a sucker born every minute.” The truth is, there are new scams born every minute, especially in the Internet age. While I couldn’t possible list every scam that’s been played, I can make you aware of some of the most prevalent scams out there. By familiarizing yourself with some of the most common scamming techniques, you’ll be ready to immediately avoid the situation should someone try to pull one off on you.
We’ve all been in a situation where we genuinely want to return a favor. If a neighbor takes in your mail while you’re on vacation, or a family member babysits your kid while you’re in a pinch—it’s normal to want to pay them back by lending a helpful hand. Essentially if someone does something nice for us, we have a natural inclination to return the favor. In some instances, however, our natural inclination to return favors can get us in big trouble. This is the case when someone purposefully exploits the law of reciprocity and expects something much bigger than she’s given in return. For example, your neighbor may have agreed to walk your dog on a day when you were away, which is a nice thing to do. You’d likely be comfortable doing something similar in return, like feeding her cat or watering her plants while she’s on vacation. It wouldn’t make sense however, if she showed up one day and let you know she expected you to paint her house or mow her lawn for the entire summer. The trouble starts when criminals use the law of reciprocity against someone by expecting much larger things than they’ve given in return.
On May 1, 1990, Pamela Ann Smart came home from work to find her home ransacked and her husband shot dead. After a sensational trial, Smart was convicted for conspiring in a first-degree murder that was ultimately carried out by her fifteen-year-old lover and two of his friends. Smart met the teen, William Flynn, at a school program where they both were volunteers. As their relationship developed, she confided in Flynn that she’d like to see her husband dead. Eventually Smart threatened to stop having sex with Flynn unless he agreed to kill her husband. Flynn was sentenced to twenty-eight years to life for his involvement in this murder. The other teens were convicted of murder conspiracy or accomplice charges. During the trial, it came out that Smart had accused Flynn of not loving her. She told him if he really loved her, he would be willing to kill her husband.
Smart used the law of reciprocity against Flynn to get what she wanted. She initiated a relationship with a vulnerable young person, gave this person sex, and insisted that something was to be done for her in return. Obviously this is not how normal relationships work—Smart set up a situation that allowed her to socially engineer someone into committing murder for her. In the intelligence world, the law of reciprocity may start with someone buying drinks for you . . . or gifts, and then asking for a small favor. This small favor usually represents the beginning of a very slippery slope. The bottom line is, even if you owe someone a favor, you should by no means feel guilted into doing something that doesn’t feel right to you.
Tymikia Jackson was pumping gas in a Georgia gas station when she was approached by a couple looking for help. A woman asked her if she would give her some money to put gas in her car. Jackson wanted to help the couple and happily handed over the last $20 bill she had in her wallet. The woman thanked Jackson and was so happy that she asked if she could have a hug. Jackson complied. A man got out of the driver’s seat and approached Jackson. He said, “Thank you so much. I really appreciate it. Can I please have a hug?” Jackson noted that the hug felt different. The next morning, Jackson figured out why the couple were anxious to give her a hug: about $3,000 was missing from her bank account. Only a couple of hours after she left the gas station there were two large charges on her debit card and withdrawals from ATMs. It turns out that while they were hugging her, the thieves used high-tech scanning devices to take information from her credit cards, which were in her front pocket.
Jackson is actually lucky it was just her credit card number that was taken. Putting yourself at someone’s mercy as a Good Samaritan can cost you your life. While it’s admirable to want to help others—especially those in desperate need—it’s essential that by doing so you don’t put yourself in a position where you could be harmed.
Ted Bundy, the notorious serial killer who confessed to thirty homicides committed in seven different states in the 1970s, was a master of the Good Samaritan scam. Bundy was known for being handsome and very charismatic. He tended to approach his potential victims posing as an injured person. It was not unusual for him to use crutches, and plaster of Paris for making casts was found in one of his homes. When women were disappearing at a college campus about sixty miles southeast of Seattle, several witnesses reported seeing a man fitting his description—with his leg in a cast, or his arm in a sling—asking for help carrying things to his car.
Obviously not everyone asking for help is in fact a depraved serial killer. However, Bundy’s story illustrates how easy it is to become vulnerable when agreeing to do something as simple as help an injured person walk a few feet to their car. It is our instinct as human beings to do good, but it’s important to not let a desire to be a helpful person reign over safety. In Batesville, Indiana, a man pretended to be a stranded motorist, looking for Good Samaritans to scam. He’d pull over to the side of the interstate and wait for help to come along. When an elderly woman stopped, he was able to convince her to lend him money so that he could repair a mechanical problem with his vehicle. The con artist then called the same Good Samaritan the next day. Unfortunately, she still didn’t recognize the scam, and she gave the man directions to her house so that he could pay her back. When he arrived at the residence, he entered the home without permission and distracted the woman long enough to steal her wallet. In Vancouver, Shirley Magliocco was returning from a trip to the grocery store. A couple approached her in her driveway, asking her for water for their overheated van. When she walked into the house, she forgot to turn off her alarm system, and went upstairs to turn it off. As soon as she came downstairs the couple was gone, and so was her wallet.
The bottom line is that there are countless ways a criminal can take advantage of your good nature. Before agreeing to assist someone, make sure you’re not isolating yourself, don’t ever get in someone’s vehicle, and don’t be afraid to leave immediately or call for help if you’re uncomfortable.
In Die Hard 4: Live Free or Die, the character Matt Farrell (played by Justin Long) successfully uses a fake illness as a pretext. He tells the OnStar assist representative that he needs the car to get to his father who is dying of a heart attack. This convinces the representative to start the car, which Farrell is actually in the process of stealing.
Pretexting is when a scenario is invented to engage a person so that he will perform actions or give away information that he wouldn’t be willing to do otherwise. Pretexting often involves an elaborate lie. A criminal engaging in pretexting may impersonate coworkers, a bank employee, an insurance investigator, tax authorities, or even a clergyman. A pretexter may impersonate any person who could be perceived as having the power to get a person into a particular situation or who has the right to know certain information.
In Manatee, Florida, a woman might owe her life to successfully recognizing a pretext. Late on a Sunday night, a woman pulled over after she saw red and green flashing lights. A tall, clean-shaven male asked her to get into his vehicle. He did not ask for license and registration, so she refused to get out of her car. The man told her he was going back to his car to call for a female officer, but instead fled the scene at a high speed. This woman would not normally have gotten into a car with a stranger. Luckily she had the awareness to recognize that the situation was engineered to get her into his vehicle. After the car pulled off she immediately called 911.
How Can You Spot a Pretext?
There’s a man in Tennessee who is probably very regretful that he let himself be the victim of a distraction robbery. Stephen Amaral from Crossville, Tennessee, was approached by a couple with a very unusual request. A woman asked Amaral if she could “take a skinny dip in his pool” while her husband went out to buy cigarettes. Amaral proceeded to watch the woman swim naked in his pool for about twenty minutes. Turns out, while Amaral was watching her swim and even providing her with a towel, her husband was inside robbing his house.
People are easily distracted, and criminals know this. It’s not terribly difficult to choose a person, or even a group, and create a means of distraction. At times the distraction may be high impact. In Grenada, Mississippi, three people were arrested after calling in bomb threats to two area schools. While the police were searching and evacuating the campuses of the two schools, two masked men robbed a local bank. Most distractions, however, are going to be smaller scale, and the criminal will attempt to distract you immediately and quickly. The criminal hopes you won’t suspect a thing—until you realize your purse or wallet is missing. In San Clemente, California, an eighty-six-year-old man lost $200,000 worth of jewelry. A man approached the elderly homeowner posing as a contractor. He offered his roofing services, which the man accepted. The man was told that the contractor’s son was with him. He asked the elderly man to watch out for him while he went up on the roof. Meanwhile, the “contractor” entered the house and stole jewelry. On High Street in London, a woman withdrew a large amount of cash before heading to the grocery store. She was approached by a group of two men and a woman, who told her she had “something on her back.” They insisted on helping her wipe it off. While she was distracted, the cash disappeared from her handbag. While many criminals choose to target the elderly when pulling off a distraction robbery, anyone can be a victim to this type of crime.
Like the Good Samaritan scam, distraction scams can get pretty imaginative. There are no limits to what a criminal will do to distract you. So how do you avoid becoming the victim of a distraction?
You wouldn’t think so, but CIA officers are often the target of social engineering. It’s not uncommon for CIA officers to be approached in a bar, often by a beautiful woman with a big story to tell. CIA officers are even warned about being pitched out in public. I remember I was once in a bar with some of the other officers after work, and I was approached by a woman, who I quickly learned was from Belarus. I didn’t know this woman at all, but that didn’t stop her from launching into an incredible story about her life. She told me that she was terribly abused by her brute of a husband—she had been sold to this forty-something guy when she was only eighteen. She eventually got away from him and into a shelter, where she suffered even more abuse. Despite all of this, she somehow managed to get out of these terrible situations and put herself through medical school. Her willingness to open up and share such personal and tragic information was a red flag for me. I knew she was expecting me to open up with just as much information in return—and who knows who she was going to give it to? Luckily, because of my training, I wasn’t going to reciprocate by giving out equally personal information. This woman also was not exhibiting normal human behavior. If someone wants to hit on you at a bar, they’re going to put their best foot forward, not open up with a story about being a mail-order bride who was raped by her husband.
While I’m certainly not suggesting that you use social engineering to do anyone harm, I will admit that it’s possible to have some fun with it. There are plenty of ways we convince others to do things we’d like them to do. Following are a few of the more imaginative ways you could use social engineering to your advantage—and techniques you should keep in mind in order to avoid being socially engineered yourself.
Have you ever wondered what it feels like to be famous? Twenty-three-year-old Brett Cohen used social engineering to find out. After checking out Times Square in New York City, Cohen decided it was the perfect place to make his debut as a celebrity. Cohen created his own entourage, hiring two bodyguards off of Craigslist, three cameramen and four photographers. Cohen, who is a regular-looking guy, put on a nice shirt, a pair of dark glasses and a bright smile. Cohen carefully exited the 30 Rock building in Rockefeller Center, flanked by two large and serious looking security guards. His cameramen and photographers got right to work. Cohen flashed a huge grin, and exuded confidence. He blew kisses into the crowd. The crowd ate it up immediately. Cohen had a friend ask people what they thought about the famous Brett Cohen. One man said he was “a very good actor,” referring to a part he obviously did not play in a Spider-Man movie. Another man was asked what he thought of Cohen’s music. The man replied that he had “heard his first single.” Cohen posed for pictures with fans as they followed him around Times Square for three hours. A group of girls, who were screaming and blowing kisses, said, “This is the best day of my life! I love him! He’s beautiful.” Toward the end of the prank Cohen had nearly three hundred people following him. Concerned the police would get involved because of the large crowd that was gathering, Cohen had his two security guards escort him into a small hotel, gesturing to the crowds to stay back. In the video he made of the experience, Cohen is seen after it’s all over, walking down the street, and onto the subway alone. Once his entourage was gone, so apparently was his celebrity.
If you want people to put their guard down, chances are, having a baby with you will help. I’ll admit that this one is most likely going to work only for a man. Unfortunately, we’re brainwashed, and the truth is, we don’t think twice about a woman taking care of a baby. If a father takes the baby out to the grocery store? He’s automatically considered father of the year. A friend of mine noted that her husband got a completely different reaction from nurses at the pediatrician’s office than she would have. Her husband took their sick baby in to see the doctor, and left the diaper bag at home. The baby got hungry and started wailing for food. The nurses immediately jumped in with a bottle and formula and were basically just impressed that dad was taking the baby to the doctor at all. “If it were me, and I had forgotten the bottle, I would have been viewed as the worst mother ever. But my husband gets praised just for showing up!” If a man is holding a baby out in public and asks for help, chances are most people will be eager and quick to respond to a helpless father. There’s something about the presence of babies and children that just make people more comfortable. We’ve all heard stories about the guy who takes his nephew out to the park to play baseball but just happens to pick up a woman in the process.
Anyone who has seen The Silence of the Lambs probably remembers the scene where Jodi Foster is trying to get information about a serial killer she’s pursuing, from another serial killer, Hannibal Lecter (played by Anthony Hopkins).
If I help you, Clarice, it will be “turns” for us too. Quid pro quo—I tell you things, you tell me things. Not about this case, though. About yourself. Quid pro quo. Yes or no?
Quid pro quo simply means “something for something.” A classic example of quid pro quo behavior is the guy who takes a woman out for a fancy dinner and expects her to come home with him. Quid pro quo tactics can easily be used in less ominous ways. A wife who wants her husband to do something around the house might make his favorite dinner before asking him. A teenager might go ahead and clean out the garage, hoping that in return he’ll be allowed to stay out late or borrow the car. Most of us use quid pro quo tactics without even realizing it. It’s an easy way to get someone to do a much-needed favor, and this is essentially another example of the law of reciprocity in action.
In the movie Wedding Crashers, Jeremy (played by Vince Vaughn) and his buddy John (Owen Wilson) are able to crash just about any wedding, even the wedding of the year: that of the secretary of state’s daughter. They boldly walk in, introduce themselves, have a glass of Champagne, and have no trouble making up a bogus reason about how they got invited. Acting like you’re supposed to be there is a powerful way to gain access to a place you’re not supposed to be. I’m not suggesting you show up where you’re not wanted or do anything illegal, but it’s fun to take a look at how some people manage to pull this off. I’ve easily gotten into buildings for building penetration jobs because I chatted up the security guard and acted like I was supposed to be there. Society is brainwashed to believe in the power of a badge or ID. People see a company ID, even one easily made at home, and assume immediately you’re on the up and up.
People who manage to gain access to venues and parties have mastered a few key skills. They appear completely comfortable and confident, even though they may actually be sweating inside. They’ve probably taken the time to make sure they blend effortlessly into the environment they are infiltrating. For example, had Owen Wilson’s character shown up to the secretary of state’s wedding in a bad suit, he might have stuck out. Gaining access to places you’re not supposed to be means appearing like you have control of your surroundings. Don’t look around checking the place out; you need to move around naturally, like you’ve been there many times before.
Everyone has a motivation—something that drives him. We all have different interests and hobbies that make us unique individuals. But if we’re not careful, our motivations can be used against us. I enjoy shooting and really like guns, and it’s pretty easy to find this information about me. I wouldn’t let someone’s shared interest in guns lure me into an off-the-beaten path gun store where he could do me harm. But sometimes finding others’ motivations is a good way to socially engineer them.
I heard a story about a few men hitting on a beautiful model at a bar. The first guy was a billionaire businessman. He approached the woman and was immediately shot down. The second guy was a famous movie producer. He didn’t do any better than the millionaire. The third guy was fat and short. The other guys see him whisper into this woman’s ear, and before the other men know it the couple is leaving together. The couple return to the bar an hour later and go their separate ways. The businessman has to know. He walks up to the short guy and says, “What did you say to her?” The short guy tells him, “I asked her if she’d like to come back to my place and do cocaine.” The third guy found her motivation.
Obviously it wasn’t too hard to find this woman’s motivation. It’s important that you take steps to make sure someone can’t easily find out what motivates you. Those of you who use Facebook, make sure you use privacy settings and be careful about what “friends” can learn about you from visiting your page. If it’s obvious you’re a graduate of a particular college, work in a certain industry, and enjoy hiking—it would be easy enough for someone to get in your good graces by sharing those common interests. I’m not suggesting everyone you meet who has a shared interest with you has dark intentions—just think twice about letting your guard down because a guy you meet at a bar likes the same bands and also volunteers with children.