€
Cybercriminals
Money through fraud, extortion or stolen access.
// public clues · believable stories
What would make
you believe it?
Explore who might target us, what makes a story persuasive, and how our online footprint can make it feel personal. Then build a scenario and challenge it together.
60 minutesteams of 2–3self-audit + team exercise
01 / WHO AND WHY
Different actors. Different motives.
◎
State-linked actors
Espionage, influence or disruption.
!
Hacktivists
Publicity or impact for a political or social cause.
↗
Malicious insiders
Misuse access they already have, for gain or grievance.
?
Opportunists
Try accessible targets with reusable scams or tools.
Discuss: who might benefit from your information or access—and what might they want?
02 / A SHORT READ
When the assistant becomes the target.
The security brief2025 case · AI security
A crafted email could make Copilot leak internal data
A vulnerability called EchoLeak showed how an ordinary-looking email could carry malicious instructions for Microsoft 365 Copilot. Under certain conditions, the assistant could be steered into disclosing limited internal information already accessible to the user.
Microsoft fixed the flaw, tracked as CVE-2025-32711. The case illustrates a risk when an assistant processes outside content: material it should read as data can instead influence its behaviour.
Short paraphrased case summary, not a report of a confirmed customer breach. Source: Microsoft Security, 17 December 2025 ↗
Discuss: who or what is being influenced? At what point is outside content trusted?
Human persuasion and prompt injection are different mechanisms. Both invite us to examine where trust is granted.
03 / WHAT MAKES A REQUEST PERSUASIVE?
Eight elements to recognise.
Open a few examples. Which would matter in your situation? Add others.
Authority
“I’m calling from IT.” A claimed role makes a request seem legitimate.
Urgency
“We need this now.” Time pressure reduces the opportunity to check.
Scarcity
“Last place available.” Fear of missing out makes delay feel costly.
Social proof
“Everyone else has done it.” Other people’s supposed actions normalise a request.
Familiarity and liking
A shared interest, familiar name or friendly manner makes contact feel expected.
Reciprocity
“I helped you earlier.” A favour can create pressure to return it.
Commitment and consistency
A small initial agreement makes a larger follow-up feel like the next step.
Emotional pull
Fear, excitement or the wish to help can compete with careful checking.
In pairs: pick two elements. When are they useful in ordinary life, and when could they be exploited?
Discussion prompts, not a formula for predicting behaviour. Several draw on Cialdini’s persuasion principles; urgency and emotional pressure are added here.
04 / CHECK YOUR OWN FOOTPRINT
What could make a story feel personal?
Choose two checks. Search only yourself; keep the findings private. You can use a fictional profile instead.
2 min choose · 7 min check · 3 min reflect0 / 4 checked
Check your own email at Have I Been Pwned ↗. Read dates and data categories. No password needed.
Record categories, not names or addresses. No search result or breach match is a complete picture. Notes stay in this open page and clear on refresh.
05 / TEAMS OF 2–3
Build the story. Then challenge it.
Pick a fictional or volunteered target. Describe the scenario; do not send messages or make calls.
3 min / choose6 min / create8 min / challenge5 min / role-play and revise
Your scenario
Under what conditions could it work?
Consider timing, workload, an expected interaction, believable information and a process that allows the request.
Under what conditions would it fail?
Consider a separate verification channel, access limits, a second approval, or feeling comfortable saying “let me check”.
One person plays the social engineer; one plays the target; the third observes. Swap roles. Change one condition and try the scene again.
In a pair, discuss the observer’s view afterwards. For an AI scenario, map the content, permissions and trust boundary instead of attributing human psychology to the model.
06 / SHARE AND REFLECT
What changed the outcome?
2 MIN / SHARETwo teams share a pretext and one condition that changes its credibility.
2 MIN / DISCUSSWhich process or supportive response makes checking easier?
2 MIN / CHOOSEPrivately choose one visibility change or verification habit to take away.