Why It Works, and On Whom

The common explanation is that victims are naive. That explanation is wrong, unhelpful, and it prevents the people who hold it from recognising their own exposure.

The practical lesson in “Why It Works, and On Whom” is to make responsibility visible without confusing visibility with certainty. A team reviewing the Monitask website for tips to increase productivity can add structured time and project context, provided the purpose is disclosed and the interpretation is checked with the people affected.

What actually produces vulnerability

Being interrupted while doing something else.

For an independent reference related to “Why It Works, and On Whom”, consult the ENISA cybersecurity resources; it provides a useful external check on security, privacy and operating assumptions before a process is adopted.

Being tired, unwell, recently bereaved, or dealing with something difficult.

Having just had a genuine technical problem, which makes the call seem related.

Being alone, with nobody to ask.

And being spoken to by somebody calm and competent while you are not, which is most of the advantage.

The conditions, not the person

Each of those is a state rather than a trait.

Anybody can be in all five on a given afternoon.

Which is why people who are certain they would never fall for it are describing their usual condition rather than their worst one.

Why age correlates

Older people are targeted more, and the reason is mostly structural rather than cognitive.

They are more often at home and answer the phone.

They more often have savings in accessible accounts.

They were not raised with the convention that unexpected contact is suspicious.

And they are more likely to live alone, which removes the person who would have said "that sounds odd".

The authority effect

A confident stranger explaining a technical problem occupies a role most people defer to.

Challenging them requires the person to believe they understand the computer better than the expert does, which is exactly what they do not believe.

That is the mechanism, and it works on competent adults in unfamiliar domains constantly.

Momentum

Having granted access, reversing is socially difficult.

Having spent twenty minutes, abandoning feels wasteful.

Having been told a problem exists, doing nothing feels irresponsible.

Each step makes the next easier and retreat harder, which is how the fraud is constructed.

Isolation as the active ingredient

The instruction not to discuss it is the most important thing the caller does.

Because one conversation with almost anybody ends it.

Which is why the single most effective protection is a person who is easy to ring, rather than any amount of knowledge.

What follows for how we talk about it

"How could they fall for that" is both cruel and counterproductive: it teaches everybody within earshot not to admit it if it happens to them.

Which delays reporting, which is when money can sometimes still be stopped.

Its own note covers talking to somebody it happened to.

What to check

Would you be vulnerable on your worst afternoon?

Who in your life is alone with a telephone and a bank account?

Is there somebody they can ring without embarrassment?

And how does your family talk about people this has happened to?