Why We Trust "Security" Calls

The conversation is designed so you never make a choice. The first line assigns the roles right away: he's the expert, you're the one with a problem. After that, all that's left is to agree: it's awkward and seems silly to argue with an expert about something you don't understand.

The second layer is time. While you listen about a "recorded login attempt," one question spins in your head: will I make it in time? Hurry takes away exactly the part of your thinking that usually catches inconsistencies - the slow, boring, checking part.

See where it all turned. "Don't hang up" is isolation: you can't ask anyone for advice or step out of someone else's script. "That wasn't me" is your first agreement, small and honest; after that, it feels awkward to refuse because you're already part of the conversation. The request for the code comes last, when everything is ready.

When people are asked in advance, the answers usually fall roughly like this.

The shares vary from survey to survey, but the pattern is the same: almost everyone rates themselves above average, and everyone can't be above average. That confidence is the vulnerability - people don't prepare in advance for something they think definitely won't happen to them. The call catches you not stupid or naive, but busy: on the road, between tasks, when you really are expecting a message from your bank.

The stories change every season, but the structure doesn't. They rush you. They ask you not to go anywhere and not to tell anyone. They ask for what a real security team already knows or doesn't need: codes, passwords, full card details. Most importantly, a real organization is fine with you calling it back yourself - this conversation falls apart right there.