On How Cialdini’s Persuasion Principles Influence Individuals in the Context of Social Engineering: A Qualitative Study

While numerous cyberattacks rely on security holes in systems, social engineering (SE) prevails in successfully manipulating victims. To achieve this, attackers often exploit influence and persuasion principles. Robert Cialdini’s six principles of Likeability, Social Proof, Commitment/Consistency, Scarcity, Reciprocity, and Authority present a widely known and used conceptualization of persuasion, whether in a legitimate or malicious context. While quantitative studies have been conducted on the influence of these principles on people’s decision-making in various contexts, including a few focusing on SE, a qualitative approach is still needed to understand the reasoning behind the decisions made by individuals when influenced by these principles, especially in the SE context. We conducted 19 interviews with Arab and European participants to understand how the six principles influence trust and risk-taking in potential SE contexts. Participants were presented with twelve scenarios in which they were asked, by an imagined member of a social media group, to download and test an app that requests personal data and gives tailored recommendations about various life aspects. Six of the scenarios presented the presence of Cialdini’s principles, while the other six presented the absence of them. Participants were informed of the possibility of risks when downloading an app but also the potential legitimacy of it. Our findings show that participants reasoned their responses based on stereotypical perceptions, decision processes, and social factors. We also present differences between the rationale of Arab and European participants. The findings are important for literacy programs in security that also consider psychological and human factors.