On People’s Susceptibility to Persuasive Techniques in Social Engineering: Is It About the Technique or Their Readiness to Be Persuaded?

Social engineering (SE) typically involves persuasive elements that influence victims to take risky security actions. Among the recognised principles of persuasion are Cialdini’s principles: social proof, likeability, authority, commitment and consistency, reciprocity, and scarcity. Research has shown differences in the prevalence of persuasive techniques in SE attempts, but whether these techniques differ in manipulative power in general, and specifically when security risks are present and known, remains unexplored. More broadly, does the technique matter as much as the readiness to be persuaded and take risks? Can individuals be grouped by their receptiveness to persuasion across all Cialdini principles in the context of SE attempts? To explore this topic, we presented participants with a social media scenario in which a member requests volunteers to install an app and provide feedback. We designed 12 scenarios, highlighting the presence or neutralisation of each principle. Our online study involved 329 participants from the Arab Gulf Cooperation Council (GCC) countries and 223 from the United Kingdom. Using K-Means clustering, we identified distinct cluster profiles in both samples. Clustering revealed that, across both regions, participants in each cluster exhibited consistent susceptibility levels to all principles. For example, in the Arab sample, we identified three clusters reflecting low, medium, and high susceptibility. This study concludes that vulnerability to persuasion in potential SE attacks appears consistent, regardless of the technique. This suggests that susceptibility to persuasion and readiness to take risks may have a more significant impact than the specific persuasion technique used.