Why this tactic works
Talking someone into giving up access is easier than guessing a password, and it isn't done with a clever question but with the structure of the conversation. First, they give you a familiar role for the person you're speaking to: a support agent, a courier, a colleague from another department. The role itself explains how they know details about you and why they have the right to ask.
Then they compress time. Before you've had a chance to check reality - call the service yourself, look at the sender's address - they keep your attention in a narrow corridor: one task, one next step, no pause. In that moment, the code doesn't look like a key to your account, but like a formality within someone else's script.
- Role
- Urgency
- Small request
- Code
You can spot the tactic where these links connect. Real support won't rush you and will be fine if you hang up and call back using the number in the app. A request to say or forward a code is always the point to stop: the code exists so that no one but you knows it.
Why you freeze afterward
The most valuable time gets lost to shame. The thought, "how could I," takes up exactly the minutes when your actions could still make a difference. Shame here isn't a sign that you're foolish - it's a reaction to having been controlled, and it also gets in the way of asking for help.
The tactic is tailored not to your level of attention, but to the moment: fatigue, rushing, waiting for a call or delivery. It's not the inattentive who get caught - it's the busy.
The next hour
The window when you can still fix things lasts until they have used the access. What matters here is the order, not speed.
Cut off contact. Hang up or close the chat without explaining or negotiating: continuing the conversation works against you.
Change your password. Start with the service the code was sent for, then the email linked to it: that's how they recover access to everything else.
Sign out of all devices. Security settings have a list of active sessions - end all of them except the current one.
Contact support yourself. Not through a link in a message, but through the app or official website.
They usually don't try to use the access right away or in just one place. A day or 2 later, they may test the same details on your email, messenger, or social media - anywhere sign-in can be restored through the same number.
So over the next few days, it makes sense to go through everything else - calmly and using a list.
- Check sign-in and device lists in your main accounts
- Turn on 2-factor sign-in where you haven't yet
- Check whether any new email forwarding rules appeared
- Warn people they might be contacted in your name
Finish reading in the Miqo app
1 more minute, then a quiz at the end. Find it under “Psychology → Social Engineering”
Point your phone camera here to open the App Store or Google Play.
Sources
- The mechanisms are described in research on influence: R. Cialdini, Influence: The Psychology of Persuasion (1984) - scarcity and authority
- S. Milgram's experiments on obedience to authority (1963). Scam schemes change, but the structure of the tactic does not