How social media builds a dossier on you

A public profile is more than photos. It shows your city, workplace, last week's vacation, your dog's name, your school's name in a classmate's comment, and the circle of people you trust. Your account may be private - that narrows the picture, but doesn't erase it: some of it lives outside your profile. Your friend's photo is public, and its caption says where you were, when, and with whom; a comment under someone else's post is visible to everyone, and a colleague's name or your school's name comes up in conversation, not in your profile; chat members, event guests, and follows remain in public lists. On their own, each detail is harmless. Together, they form a pretext - a plausible reason to message you right now.

That's why a convincing message almost never starts with a request. First comes recognition: a colleague mentioned by name, a reference to a trip, a familiar detail. Recognition removes that first question, "who even is this?" - and then you're already talking instead of checking.

These influence tactics aren't new and were described long before social media - Robert Cialdini wrote about them. None of them persuades through logic. They all do one thing: shorten the time between "someone messaged me" and "I replied."

The first lever is give first: they helped, sent something useful, replied at night. You feel indebted - and the next request sounds like a fair exchange. The second is the window is closing: access will disappear, your application will expire, you need to reply today. The time shortage isn't a plot detail here, but the tactic itself.

The third is a voice from above: support, accounting, a manager, security. The role matters more than the person: it's rarely checked because it feels awkward. The fourth is everyone has already done it: "the others in the group have sent it," "everyone does it." Referring to others replaces looking into the actual issue.

All four share one sign, and you can spot it without knowing anything about security: you're being rushed and asked to give something up at the same time - a code, file, access, or confirmation. The request may be tiny. What matters isn't what they're asking for, but what you aren't allowed time to think about.

Speed really does matter here. In Verizon's breach investigation reports, people are named as a factor in most cases, and only seconds, not minutes, pass between opening an email and clicking a link.