5 ms·

A very good lesson for the company, via a red-faced Mary. She'll share the lessons from this experience widely I'm sure. Excellent that she wasn't fired. Not t

A very good lesson for the company, via a red-faced Mary. She'll share the lessons from this experience widely I'm sure. Excellent that she wasn't fired. Not to say that this is anything less than completely believable, but I wonder why Mary's boss didn't check up on the cover story? I get that Sophie was able to hack the usual social proof with Mary with her pregnancy sob-story, but wouldn't her boss have asked who sent her?

hmschreck 9y ago
This is part of social engineering that a lot of rational people just don't get. Most people will not double check, well, anything, really.
Thriptic 9y ago
A lot of large orgs have a very distributed decision making process where decisions are made far outside of a specific chain of command. Frequently it's unclear who you are even supposed to call to verify the identity of someone that just shows up. It may take awhile to even reach the right person and while you are making those calls you aren't doing your work and you are delaying the service this unknown person is theoretically there to provide. What if this person is there legitimately, you piss them off or deny them access, and then you get an angry call from someone several levels of hierarchy above you blaming you for slowing down their project? No bueno You also can easily end up with a version of the bystander effect; if someone is here than SOMEONE in the company must have validated them etc. In orgs I have worked for in the past it would have been trivial for me to show up with tools, claim to be from IT, and be given access to whatever I wanted immediately.
- scrumper 9y ago
  Thanks, that's a clear and plausible explanation.
surge 9y ago
Generally, the person whose been fooled once and made aware so they know what to look out for is better to have than firing them and replacing them with someone new whose just as likely to fall for the same thing.

hmschreck 9y ago

This is part of social engineering that a lot of rational people just don't get. Most people will not double check, well, anything, really.

Thriptic 9y ago

A lot of large orgs have a very distributed decision making process where decisions are made far outside of a specific chain of command. Frequently it's unclear who you are even supposed to call to verify the identity of someone that just shows up. It may take awhile to even reach the right person and while you are making those calls you aren't doing your work and you are delaying the service this unknown person is theoretically there to provide. What if this person is there legitimately, you piss them off or deny them access, and then you get an angry call from someone several levels of hierarchy above you blaming you for slowing down their project? No bueno You also can easily end up with a version of the bystander effect; if someone is here than SOMEONE in the company must have validated them etc. In orgs I have worked for in the past it would have been trivial for me to show up with tools, claim to be from IT, and be given access to whatever I wanted immediately.

scrumper 9y ago
Thanks, that's a clear and plausible explanation.

surge 9y ago

Generally, the person whose been fooled once and made aware so they know what to look out for is better to have than firing them and replacing them with someone new whose just as likely to fall for the same thing.