Social Engineering & Cyber Psychology: Our Lecture for IGNOU's Knowledge Transfer Series

On 7 February 2024 we delivered Lecture #7 of the Online Knowledge Transfer Series (KTS) at the Indira Gandhi National Open University (IGNOU). The topic was “Social Engineering & Cyber Psychology”. The School of Computer & Information Sciences (SOCIS) organised the series under the banner #LearnAnytimeAnywhere. Speaking for The CyberDiplomat were Sanjana Rathi, Founder & CEO, and Anupama Basrur, Executive Director. The online session ran from 2:30 to 4:00 PM IST and was open to learners wherever they were.

We were delighted to complete the lecture successfully. Here is a look at the themes behind it and why they matter to every organisation.

Attackers hack people, not just systems

Firewalls, encryption and endpoint protection have made direct technical attacks harder and more expensive. So attackers increasingly go around the technology and target the person using it. Social engineering means manipulating people into giving up information, granting access or taking an action that benefits the attacker. It remains one of the most reliable ways into an organisation. Industry breach studies such as Verizon’s annual Data Breach Investigations Report consistently find that a human element, like a clicked link, a stolen credential or a simple mistake, is involved in the majority of breaches.

The strongest security architecture can be undone by a single convincing message to the right person at the wrong moment.

The many faces of social engineering

Phishing and spear-phishing: emails crafted to look legitimate, sometimes researched down to the individual target.
Vishing and smishing: phone calls and text messages from someone posing as a bank, courier, government office or IT helpdesk.
Pretexting: building a believable story, such as a new vendor, an auditor or a senior executive travelling, to justify an unusual request.
Baiting and quid pro quo: offering something attractive, like a free download, a prize or “technical support”, in exchange for access.
Business email compromise: impersonating leadership or suppliers to redirect payments.
Deepfakes: AI-generated voice and video that make impersonation more convincing than ever.

Why it works: the psychology behind the attack

Cyber psychology looks at how people think, feel and behave online, and why that makes them vulnerable. Social engineers rarely rely on technical skill alone. They exploit well-understood features of human decision-making:

Authority: we tend to comply with requests that appear to come from a boss, a regulator or the police.
Urgency and scarcity: “act now or your account will be blocked” pushes people to skip their usual checks.
Trust and liking: attackers build rapport or pose as colleagues and friends.
Reciprocity: a small favour or gift creates a sense of obligation.
Social proof: “everyone in your team has already completed this form.”
Fear and curiosity: strong emotions narrow attention and cut short careful thinking.

Our online habits add to the risk. We process a constant stream of messages, we are often multitasking, and we share a great deal about ourselves on social media. All of this gives an attacker both the material and the opportunity they need.

Building a human firewall

Slow down: treat urgency, secrecy and emotional pressure as warning signs, not reasons to act faster.
Verify through a second channel: confirm unusual requests, especially about payments or credentials, using a known phone number or in person.
Think before you share: limit the personal and organisational details you post publicly.
Use strong authentication: multi-factor authentication limits the damage when a password is stolen.
Make reporting easy and blame-free: people who report a suspicious message, or their own mistake, quickly are an early-warning system.
Train continuously: use realistic, regular awareness training and simulations rather than a once-a-year slideshow.

With thanks

Our sincere thanks to IGNOU and the School of Computer & Information Sciences for the invitation to contribute to the Knowledge Transfer Series. We thank Prof. Nageshwar Rao, Vice Chancellor; Prof. Uma Kanjilal, Pro-Vice Chancellor; Prof. P. Venkata Suresh, Director, SOCIS; and Prof. Sandeep Singh Rawat, Coordinator (KTS). Thank you also to every learner who joined online. Initiatives like this take cybersecurity awareness to learners across the country, and we are proud to have been part of it.