Why Smart People Fall for Scams

Smart people fall for scams because criminals are skilled at pointing their attention exactly where they want it. Robert Siciliano of Protect Now has spent 30 years studying how criminals choose their victims, and his conclusion is that people get scammed while paying close attention to the wrong thing. Manufactured urgency and our built-in default to trust do most of the work. Three basics, two-factor authentication, a password manager, and a credit freeze, put you ahead of about 90% of people.

In this episode, I talked with Robert Siciliano of Protect Now, which offers security awareness training that covers both physical safety and online fraud. Robert started out in the mid-1990s teaching real estate agents how to stay safe. In 1995 he bought his first computer to run his small business over AOL dial-up, and he got hacked and lost thousands of dollars. He wanted to understand how it happened, and he's been teaching it ever since.

What's changed in those 30 years, he says, is that criminals now run fraud like a business. They have managers, frontline workers, and shifts around the clock. Most of us still treat security the way we did in 1995. When Robert asks a live audience how many people use a password manager, fewer than 1 in 10 raise their hands. Two-factor authentication on both work and personal email gets maybe 15% to 20%. I've seen the same thing. When we posted a short clip about password managers from another episode, someone commented that it was too basic, and I thought about how many people have never heard of one.

Robert explained why we resist this stuff. He calls it the trinity of vulnerability: paranoia, denial, and fatalism. People assume someone with lots of security cameras must be paranoid. They decide criminals would never choose them. Or they figure a determined thief will get in anyway, so why bother. All three end with doing nothing. I see security cameras differently. They give me peace of mind, because a strange noise at night doesn't worry me unless the camera detects a person. They also add friction, and a criminal looking at two houses will pick the easier one.

The part I found most useful was how scams get past smart people. Robert said manufactured urgency shows up in about 99 out of 100 frauds today. Pay this fine now, log in now, or lose your account. Urgency causes tunnel vision, and you stop questioning. The worst version is an AI clone of your child's voice screaming for help on the phone. You'll do anything the caller says, because every instinct you have is focused on saving your kid. Underneath all of it is what Robert calls the human blind spot. We're wired to trust, and most people deserve it, but the small percentage who don't know exactly how to use that against us. Victims often tell him they sensed something was wrong right before it happened. That feeling was their instinct, and they talked themselves out of it.

He's critical of how most companies train employees. Phishing tests produce good-looking click-rate numbers, but when someone clicks and gets shamed for it, the next person who makes a mistake stays quiet. He estimates only about a quarter of victims report what happened. Robert wants mistakes treated as data, and training that people care about enough to bring home. He calls that the kitchen table effect, when an employee teaches their family what they learned at work. His airplane oxygen mask analogy made sense to me. People protect company data better once they know how to protect themselves first.

I brought up the Axios npm package attack, where a maintainer was socially engineered and a compromised version of a widely used package went out to thousands of projects. Many of those installs were done automatically by AI coding tools. That attack started at work, but once someone is inside your machine, your family's information is exposed too.

My takeaway is to start with the basics this week. Turn on two-factor authentication for your email, bank, and shopping accounts, set up a password manager, and freeze your credit at TransUnion, Equifax, and Experian. You can still use your cards, and nobody can open new credit in your name. You can find Robert's newsletter on LinkedIn and his training at protectnowllc.com.