Most social engineering training teaches techniques that exploit emotional triggers like urgency, fear, or flattery. But what happens when the target has been trained to spot these and they are on high alert? In this talk I will demonstrate three techniques I’ve learned from studying career scammers for my research at F-Secure, and I’ll show you how to apply them to your social engineering operations. All three of these techniques work specifically for targets who have been already primed against falling for scams and other social engineering exploits. In other words, these are techniques designed for your tough cases. First, I’ll demonstrate Awareness Hijacking, where the operator uses the target’s knowledge of one scam to trap them in a different one. Then I’ll show Complexity-as-Crucible, where the operator engineers a scenario that lets them become the target’s trusted guide. Finally, I’ll demonstrate the First Win, where the operator purposely lets the target “beat the scam” without realizing they’ve actually entrapped themselves. Participants will leave with three new techniques that are directly applicable to red team social engineering engagements where the targets may be on high alert or trained against falling for more traditional manipulation techniques.

Megan Squire

Dr. Megan Squire is a Principal threat intelligence researcher at F-Secure, where she studies AI safety, scams, and fraud. Before moving into threat intel, she spent over a decade studying online recruitment, illicit finance, and adversary networks in the domestic violent extremism domain. Her work on threat intelligence and OSINT has been featured in WIRED, The New York Times, PBS-Frontline, The Washington Post, and Dark Reading.