The bait looks like someone else's lost item
A USB drive by an office entrance, in a parking lot, or in an elevator is not trash - it's a setup. It's placed where someone will definitely pick it up and labeled to give it an owner: a name, "Vacation 2026," a room number. From there, the person does everything themselves, and that's the whole point.
It works through obligation, not stupidity. A found item instantly puts you in the role of someone who can help. To return the drive, you need to see whose files are on it - and plugging it in starts to look like a decent thing to do, not a risk. That's why a name label works better than an anonymous device.
Files were opened on nearly half of the planted USB drives
The second lever is curiosity, fueled by the label. "Confidential," "bonuses," "photos from the office party" - a promise of someone else's secret that you can see with no witnesses. From the inside, neither motive feels like a mistake: you're either being kind or simply curious.
Why careful people fall for it
A scammer doesn't need a naive person - they need a busy one. The tactic catches you when you're juggling several things at once and want to resolve a small issue in 30 seconds. Your caution doesn't disappear - the find just doesn't get its own separate decision.
Only careless people fall for this. I definitely wouldn't.
In that study, ordinary people on a university campus picked up the USB drives, most often saying they wanted to find the owner. The tactic exploits helpfulness and haste, not stupidity.
Then come the same levers as in a "security service" call: urgency, a ready-made role ("you'll help, right?"), someone else's authority, and a small favor you feel like repaying. A USB drive is the silent version of that same conversation.
How to spot it
The sign is broad and fairly reliable: you're being pushed to make a decision quickly and alone. A genuine request can survive a pause and verification through a second channel - a call to the number on the official website, a question to a colleague, an email to a work address. The pressure lasts only until a second person appears.
- Take the item to someone responsible, such as reception or the system administrator
- Verify an urgent request through a channel you found yourself, not contacts in the message
- Give yourself a pause: the tactic relies on the first few seconds
- Plug a found device into your personal or work computer to "find the owner"
- Open a file labeled to promise someone else's secret
- Assume caution alone will protect you
Finish reading in the Miqo app
1 more minute, then a quiz at the end. Find it under “Psychology → Social Engineering”
Point your phone camera here to open the App Store or Google Play.
Sources
- Tischer et al., "Users Really Do Plug In USB Drives They Find," IEEE Symposium on Security and Privacy, 2016: of 297 drives scattered around a campus, 98% were taken away, and files were opened on about 45%