You Should Be Afraid of Fear: How Phishing Uses the Psychology of Fear

A common phrase used in recognizing a scam is to question whether something is too good to be true. However, when it comes to phishing scams, I think it’s equally useful to question if something is too bad to be true. Often, scammers get their victims to panic into letting their guards down by catastrophizing. Email subject lines such as ‘YOUR IDENTITY MAY BE AT RISK’ and scam phone calls that claim the government is involved and they aren’t happy with you have become commonplace. I want to discuss this new take on an old scam. 

        I think the biggest reason for this shift in scam framing is that scammers have learned to take advantage of people's fear of loss. A quote from Zig Ziglar’s Secrets of Closing the Sale states that “the fear of loss is greater than the desire for gain.” Scammers have realized the truth of this phenomenon in recent years and are adapting their phishing strategies to take advantage of it. Most people would appreciate being given a million dollars with no strings attached, but would rightfully consider the offer at least a little sketchy. However, when faced with the prospect of losing thirty thousand dollars out of your own bank account, you are no longer being manipulated by greed. Scammers create a fake situation to create real desperation. Desperation makes people sloppy, but it also makes them too afraid to care. Modern scammers are more than happy to prey on this. 

        If an email suggests that giving your banking information to an exciting new investing opportunity that will more than quadruple your money, even a fairly trusting person might be suspicious that an offer that sounds so good might be hiding sharp teeth and shifty intentions. 

Thus, spear phishing has learned to use social engineering to create urgency and tie that to a sense of trust and gratitude to the source that warned you of the danger and offers to ‘fix’ the problem. If all you need to do to protect everything you’ve worked for is to confirm your bank login via email, a panicking victim might easily make a choice that a calm, level-headed person would think twice about. 

I believe that the idea of ‘too good to be true’ can also be applied in reverse. An email that warns of a life-altering catastrophe should be met with the same skepticism of an email that offers a life-changing windfall. However, those two emails feel different, and forcing rationality is a lot easier in the second situation than the first. Modern phishing scammers have learned to threaten your sense of safety and take advantage of the fear they create. They fabricate a problem, and with the highly-tailorable nature of spear phishing, they can offer an extremely persuasive solution. 

        People have always been able to adapt to the scammers of their age, and modern phishing techniques will be no different. This adaptation trains people to question their natural desire to protect themselves and their loved ones. Trust and sincerity have been punished enough that they must be applied cautiously in today’s world. If you ask me, that’s the most insidious thing of all.