When we think of hacking, we think of a tech-savvy dude breaking into computer systems to steal data. But hackers can also take the form of “social engineers” who get what they want by building rapport and penetrating psychological defenses.
My guest is an expert and pioneer in the area of human hacking, and shows individuals and companies the weaknesses of their security systems by breaking into their offices and computers, not by bypassing pass codes and firewalls, but simply by walking in the front door, and knowing how to ask for and receive access from the humans who run the show
His name is Chris Hadnagy, and he’s the author of Human Hacking: Win Friends, Influence People, and Leave Them Better Off for Having Met You, which takes the social engineering principles con men and malicious social hackers use to breach security systems and steal data, and shows the average person how to use them for positive ends in their personal and professional relationships. Today on the show, Chris shares how assessing which of four styles of communication someone prefers can help you better connect with them, why you should approach every interaction knowing your pretext, the keys for building rapport, and the difference between manipulation and influence. We end our conversation with tips on the art of elicitation — how to get information from someone without directly asking for it.
If reading this in an email, click the title of the post to listen to the show.
Show Highlights
- What is human hacking?
- Using the DiSC assessment to figure out which of 4 types of communicator someone is
- Using “pretexting” to decide how to approach a conversation
- How to build rapport with others
- How to influence, persuade, and have hard conversations with your kids
- Why offering choices leads to greater compliance
- The difference between manipulation and influence
- How to get information from someone without asking for it directly by having an “elicitation conversation”
- Why it’s helpful to outline a conversation before having it
Resources/Articles/People Mentioned in Podcast
- Con man Victor Lustig, who tried to sell the Eiffel Tower
- AoM interview with former con man turned security consultant Frank Abagnale
- Why People Do (Or Don’t) Listen to You
- Lessons in Building Rapport From Experts in Terrorist Negotiation
- How to Build Instant Rapport
- DiSC assessment
- AoM’s interviews with former FBI agent Robin Dreeke on the code of trust and the 6 signs to look for when sizing someone up
- The Charismatic Man: The 3 Elements of Personal Magnetism
- How to Become a Good Listener
- How to Design Conversations That Matter
Connect With Chris
Listen to the Podcast! (And don’t forget to leave us a review!)
Listen to the episode on a separate page.
Subscribe to the podcast in the media player of your choice.
Listen ad-free on Stitcher Premium; get a free month when you use code “manliness” at checkout.
Podcast Sponsors
Click here to see a full list of our podcast sponsors.
Read the Transcript
Brett McKay: Brett McKay here and welcome to another edition of The Art of Manliness podcast. Now when we think of hacking, we typically think of some tech-savvy dude breaking into computer systems to steal data. But hackers can also take the form of social engineers. Individuals who get what they want by building rapport and penetrating psychological defenses. My guest today is an expert and a pioneer in the area of human hacking. He makes his living showing companies the weaknesses of their security systems by breaking into their office and computers, not by bypassing pass codes and firewalls, but simply by walking in the front door and knowing how to ask for and receive access from the humans who run the show.
His name is Chris Hadnagy, and he’s the author of Human Hacking: Win Friends, Influence People, and Leave Them Better Off for Having Met You. In this book, he takes the social engineering principles con men and malicious social hackers use to breach security systems and steal data and shows the average person how to use them for positive ends in their personal and professional relationships. Today on the show Chris shares how assessing which of the four styles of communication someone prefers can help you better connect with them. Why you should approach every interaction knowing your pretext. The keys for building rapport. And the difference between manipulation and influence. And we end our conversation with tips on the art of elicitation, which is how to get information from someone without directly asking for it. After the show’s over check out our show notes at aom.is/humanhacking.
Alright Chris Hadnagy, welcome to the show.
Chris Hadnagy: Thank you for having me.
Brett McKay: So you are a hacker. Now, I think when… I think if you grew up in the ’90s like I did, you have this sort of archetypical idea of what a hacker looks like… What they do. So they usually… They’re in a dark room, fiercely tapping at a keyboard in front of a monitor with a black screen with the green fonted code cascading down… Maybe listening to The Prodigy.
Chris Hadnagy: Yeah.
Brett McKay: But that’s not what you do. You do… There is some computer hacking involved, but you primarily hack humans. What is a human hacker?
Chris Hadnagy: That’s great, by the way. I love that image. And don’t forget the Mountain Dew…
Brett McKay: The Mountain Dew, right.
Chris Hadnagy: The Mountain Dew has to be there. So a human hacker is… Basically it’s just like hacking a computer where you understand how a computer or a piece of software works. So you inject code in order to get that program to do something it shouldn’t. A human hacker does the same thing. We understand how humans make decisions so we influence those decisions in a way that gets them to do things that we want them to do.
Brett McKay: Alright. So a nefarious version of this would be like a con man.
Chris Hadnagy: A con man, scam artist, what they call social engineers from a malicious side. And then you can have all those same skills on the good side.
Brett McKay: And your job as a human hacker is companies hire you to hack in to their companies… And that’s not just computers, but it’s like getting it into secure areas where people shouldn’t be… Your job is to do that, so these companies can figure out, “Okay, we need to change this in our security protocol.”
Chris Hadnagy: Yeah, so we call it adversarial simulation, which means that a company hires us to say, “Hey, we know you’re not the bad guy. We want you to make believe you’re the bad guy and tell us if you can get in.” So we’ll do everything from phishing, like email based attacks or vishing, phone-based attacks. Or we’ll physically go on site and break into a building, both in broad daylight and in the middle of the night. And then we tell them, “Hey, here’s how we did it.” And here’s what worked. Here’s what didn’t work. And here’s why, you need to improve these particular areas.
Brett McKay: And how did you get started with this? ‘Cause… We’ve had Frank Abagnale on the podcast before. And this is a guy… He was a con man, and then now he tells companies how not… What people like him used to do. Did you start off as a black hat hacker and then became a good guy? A white hat guy?
Chris Hadnagy: I love that question… So that is the common story, but I got fortunate. So I was in college for computer programming, and I was of course interested in telephony at the time, what they call phone freaking. And I wrote a program that today we would call a war dialer. And I shut down my whole county’s phone system for a day. And that, of course, ignited a flame in me. I was like, “I need to know more about this.” And started reading and researching. And then it kinda went away. And it was years later… Maybe a decade later that I started working in the field with a company that did network pen testing… So network adversarial simulation. And I was really bad at coding. I mean, I did it… I have a couple exploits under my name, but I wasn’t great at it.
So I found it easier to deal with the humans. So I started doing that. And when I started doing that, it wasn’t an industry, there was nothing around it. So I actually wrote the world’s first framework for social engineering and that formed my company. So it’s kind of a quick version of a long story, but that’s how I ended up doing this for a living, is I actually helped create the industry that does it now.
Brett McKay: And I imagine your services are high in demand now, ’cause this stuff is just… I mean, there’s not a day that goes by that I don’t get some sort of phishing text from somebody about something.
Chris Hadnagy: It’s unbelievable. If you and I were having this conversation seven or eight years ago, I might have said, “Yeah, this is gonna be a big thing.” I would not have seen the way the world would have gone now. I mean, everything involves social engineering. When you have a 17-year-old that can hack Twitter with one phone call, the whole world is vulnerable. And we see phishing, vishing… They’re trying to hack the… Nation states, trying to hack the freezers that are holding the COVID vaccine right now through phishing emails. It is just non-stop, barrage of attacks globally.
Brett McKay: I forgot about that Twitter hack. That was a big one. The person got access… I think…
Chris Hadnagy: That was a huge one.
Brett McKay: What happened, they got access to the back end basically?
Chris Hadnagy: So twitter has a… Yeah… A special database that houses like some of the really high-end people like Elon Musk and president Obama and people like that. And this kid wanted access to it. So he called up, got a hold of someone in Twitter support, said he worked in this other department and needed access. Had enough information that he sounded legitimate. Spoofed his phone number, and the guy on the phone gave him the user name and password and gave him access. So he logged in and in eight hours stole $300,000 in Bitcoin.
Brett McKay: That’s crazy. And so I think this drives home the point that a lot of hacking is not just you’re putting in… Injecting computer code, it is you are manipulating people… There’s a social aspect of it… That’s… And that’s often the most vulnerable part, because as we all know, humans are extremely fallible. And what is it… What, PT Barnum, supposedly said there’s suckers born every… We’re gullible… We want to believe or trust, that people are good people, and we’ll just go along and give them information that we probably shouldn’t have done.
Chris Hadnagy: And you know, I look at the science behind that… I laugh at PT Barnum’s statement, but I like to twist that a little differently. Is this is the way we survive as a species. Imagine if everybody we met, we were automatically built in to be distrusting and we thought you were a terrible person… We wouldn’t be able to survive. We would be no better than animals. That we just breed when it’s a time of the year, and then we procreate that way, and that’s it. But our ability to interact in social environments is what makes us different and what makes us human. And that ability… We don’t want people to lose that, but scam artists, con men, that’s what they play on.
So the idea is to get people aware that these things happen, so they can be better protected. Think of it as learning a martial art or learning how to box. And if you don’t know how to fight at all and someone throws a punch, you may take it square in the face. But if you had any martial arts training or boxing training at all, someone throws a punch at you, muscle reflex goes into action and you block it. So that’s the goal here is to help people learn that these things can happen. So A, they can use them in their life for betterment, but also they can stay protected from the bad guys.
Brett McKay: Alright, so con men use… Basically, what con me are… They’re very adept. They understand how humans work and the emotions and the social processes that go on in human relationships. They use that for nefarious. You use those things to show companies and governments possibly where weaknesses are and how you can protect yourself from con men. But in your latest book, Hacking Humans, you make this case that the same things that con men used to steal Bitcoin or secrets from companies, these same ideas or practices or tactics can be used to enrich our everyday relationships. Relationships between husbands and wife, parents and kids. How so? What is that… How can the same thing be used for completely opposite ends?
Chris Hadnagy: Yeah, I love that. So let’s think about, first of all, to answer that from a con man how he gets people to fall for things… So a con man comes up and he uses the… And maybe not even understanding the science, but he uses the science behind a molecule in our body called oxytocin. And he tells you a secret. He tells you… I’ll use Victor Lustig. He was a famous con man that sold the Eiffel Tower, a couple of times. He actually conned Al Capone successfully and didn’t get killed. And what he did is he always had secrets, “I’m gonna tell you this thing that nobody knows. The Eiffel Tower’s about to be taken down, and that scrap metal’s gonna go for millions of dollars. If you want in, I have a road in.” And when you feel trusted by someone, your brain releases this chemical oxytocin and it makes a connection between two people that is really hard to break.
So let’s take just that one principle. When I’m interacting with someone else, my wife, my kids, an employee, someone at a grocery store, I can go into that interaction only thinking about what I want. I want this out of this conversation, so all I’m gonna do is talk about this and I’m gonna point the direction this way. But if I go into the conversation thinking, “You know what I wanna leave you feeling better for having met me.” And I’m gonna think about what you want out of this conversation. And I enter it that way, I build a bond with you and a trust with you that will make you more compliant to the things I want. And that’s not manipulative, it’s just learning how to communicate in a way that brings peace and harmony as opposed to argument and dissension.
Brett McKay: Right. Con men are often… They know how to be friendly. They know…
Chris Hadnagy: Yes.
Brett McKay: When it comes down to… And you say one of the foundational principles of hacking humans, of human hacking is empathy… So are con men… Are they empathetic?
Chris Hadnagy: Oh they are… So think about what empathy really means, ’cause sometimes we get this wrong. And I think especially in Western cultures, and me as a male… We especially in our gender, get this wrong. Where I may say I’m empathetic, but, “You know Brett, I’d let you have your feelings.” That’s not empathy. That’s almost condescending. It’s not… And empathy is also not saying, “I understand what you’re going through.” Because I can’t… Let’s say you and I went through the same exact situation. We had a family member sick with COVID, I still can’t understand fully your emotional content because maybe your relationship with that family member is different. It’s closer or not as close. So empathy is not that. Empathy is allowing me to put myself in your emotional shoes to understand why you may be acting or talking or reacting in a certain way and not judging you for it.
So by literally saying, “Look, I could see that you’re stressed.” I could see this is happening. Tell me about that. Why are you so upset about this family member? Were you’re really close? And allowing you to now tell me about it. And really being curious. Now, I’m active listening. I’m trying to understand what it is that you’re going through, and I’m not offering you solutions and I’m not jumping in and interrupting you. I’m literally active listening while showing real curiosity about your life. And if we learned that skill… Can you imagine the problems that we can solve in this world, if we all can do that?
Brett McKay: So a big part of gaining more empathy so that you can… To work with people and persuade them and influence them effectively and get along with them is… You gotta understand their personality and where they’re coming from. And you talk about in the book… Dedicate this chapter that you can get a rough idea of someone’s communication personality style by running through what’s called a DISC assessment. What is a DISC assessment? And what are you… What are the categories you’re trying to figure out as you’re running though this assessment on a person?
Chris Hadnagy: So way back in the ’30s, a very famous psychologist by the name of William Marston, he’s actually the creator of the polygraph. He is the creator of Wonder Woman as a comic book hero… Believe it or not. He started to analyze and catalog communication points that indicate a certain type of communicator. And he broke them into four categories. So you have very dominant or D type communicators. I that are influencers. S that are very steady and people-orientated. And then C, that are very conscientious organized communicators. And when you look at someone… And you can look at them just from across the room as they communicate with friends, family, employees, or the pictures they have, their social media… Any of those things can indicate what kind of a communicator that is.
Now, if I understand the type of communicator you are, and I’m trying to influence you, whether it’s for good or bad, I can come up and communicate with you in the way that you desire. And if I do that, your brain will automatically reward you with dopamine, and that will be related to me. So you’ll feel good because you’re getting something that you like and enjoy, and I’m the reason you’re getting it so you’re gonna be more compliant with the things that I ask for.
Brett McKay: Is like… I’ve done… Is the color code based on this? I’ve done that… The color code book.
Chris Hadnagy: Yeah, so it’s similar. It’s very similar to that.
Brett McKay: Okay. It’s similar…
Chris Hadnagy: And because the reason I like this… Like let’s say over Myers-Briggs is you really can’t teach someone to do a Myers-Briggs profile on the fly. I can’t look across the room and go, “You’re an INTJ… ” That’s like impossible. But with DISC, you can just take a few seconds… Even a photo or a screenshot of their social media, and we can clearly indicate what kind of a communicator that person is. And even if you can just get it into 50% of the quadrant, you have a better chance of communicating with them in a way that will make their brains reward them and that goes well. And think of this from a not an attacker standpoint. Imagine you have to go talk to your spouse about something difficult. You have to talk to your brother or sister about a family problem. If you do that in a way that’s in their communication style, they’re gonna be more prone to listen to you and to want to take the action you want them to take because you rewarded them with this gift.
Brett McKay: Right. And so if they’re a dominant style, but you try to approach them like an influencer style, where you’re trying to like, “Hey, what’s going on… ” And they’re gonna be like, “You’re beating around the bush. What do you want? Get to the point.”
Chris Hadnagy: Right.
Brett McKay: So that’d be an example of two conflicting communication styles. And you would wanna be… Just to the point. “Hey, I need… ” The example you use throughout your book is, “I need $10,000 for help with mom’s healthcare” or something like that. Just say that. If they’re dominant, you say, “Hey, I need $10,000 bucks from you.”
Chris Hadnagy: Yeah. And if I’m an I, like you said, and I’m all jovial and jokey and I don’t get to the point really quick. And my sister is that D communicator, and I’m there at the table and like, “Look, I really talk to you about something important.” But, “Hey, first, how’s life going?”… Yeah, it’s a great color… This and that… She’s now getting irritated because she’s waiting for me to get to the point. So by the time I get to the point, her emotional content is now irritation, less likely to comply. Whereas if I were to start the conversation off with, “Look, the reason I asked you here today is I have something really serious to talk to you about mom and it’s gonna cost us as a family a lot of money. And I need to know how we can work together to make this happen.”
So I looked into this home and they want $10,000. What can we do to make this work, together? Now, I’ve presented the problem, given her options, asked her for help, and I did it without all the fluff. She’s more readily gonna be able to speak to me with empathy, compassion, compliance over if I used my communication profile to chat with her.
Brett McKay: Alright. So we talked about dominant, we talked about influencer… Steady is that more just like they’re… You care about the relationship. What is it… What’s…
Chris Hadnagy: They are. They love to really be more about the people of their group and their team or their family, winning.
Brett McKay: And then a conscientious person, they’re just detailed-oriented.
Chris Hadnagy: Very detailed. They love lists. They love color codes. They love sticky notes. They love bullet points. So for them, a decision is made by facts, figure, statistics, details. And if you don’t present those, they’re gonna doubt that you actually know what you’re talking about.
Brett McKay: Great, so again, there’s detailed assessments you can do like quizzes you can do on people… In fact, you do this with your employees…
Chris Hadnagy: Yes.
Brett McKay: You have them take this DISC assessment, but… You do this on the fly. You just kinda look and you get a thumbnail sketch of their communication style. And on that thumbnail sketch, you can make adjustments so that your communication lands better.
Chris Hadnagy: Yeah. And so if you, like in your mind, drew a circle and you put a cross in the middle of the circle so you had four quadrants. So D is in the upper left. I is in the upper right. S in the lower right. C is in the lower left. Now, on the very top of that you wrote task… I’m sorry you wrote direct, and the bottom of the circle you wrote indirect. On the left you wrote task and on the right you wrote people. Now, forget about the letters. You can look at someone, even their social media and you can say, “Are they more task or people-oriented?”… Right? So let’s take that I communicator. When you’re looking at their Twitter, they’re gonna be talking about pretty things, happy things. They’re gonna be very jovial. A lot of I, I, I, kind of comments. Which means you probably have either an I or an S.
And then you see, “Oh, but they’re direct. They’re not beating around the bush, they’re not about the team. That makes them an I. So you could do that in a few seconds and now I know what kind of a communicator you are, and I can easily then adjust my style to match yours or to communicate better.
Brett McKay: Alright, so that’s sort of the first step in hacking humans.
Chris Hadnagy: It is.
Brett McKay: The second one is this idea… It’s… Happens in social engineering. It’s a concept called pretexting… What is pretexting?
Chris Hadnagy: So… It’s really making up the act of what it is that you’re going to be for this engagement… So from a hacking standpoint, it’s I’m pest control, I’m a repairman, I’m a fellow employee… Even though I’m none of those things, it’s the pretext. But in real life, we don’t want to do something that’s unethical or unreal. So you have to choose a pretext that is more realistic.
Brett McKay: So how do you do that? How do you pretext ethically?
Chris Hadnagy: Oh… So I’ll give you an example of my family. So let’s say I have my daughter… She did something she wasn’t supposed to do. I have a couple of pretexts I can approach this as. The angry dad that’s here to punish. The empathetic dad that wants to understand why you did this. Or the aloof confused dad that has no clue what’s going on.
Brett McKay: Gotcha. You can do this if you’re a boss. You can be angry boss, concerned boss, etcetera. And how do you figure out which pretext it takes? Is it just based on the situation, the personality of the person? How do you figure that out?
Chris Hadnagy: Yeah, that’s a great question, by the way. So there’s a couple of factors. First is the situation, as you mentioned, that’s number one. But then really, the next thing you have to think about is what is the desired outcome? So what do I want? So let’s use your situation as a boss. So let’s say I work for you and I did something pretty stupid at work and you need to tell me. So you have a couple of pretexts. You could be the boss that comes in and says, “Listen, moron. That was really dumb. Like, I can’t believe you did that.” Or you can be the boss that tries to understand why did you do this and let’s figure out how to fix it. Now, the outcome is different. If you’re ready to fire me and you don’t wanna retain me as an employee, then maybe you do the first one. You get me in the office and you say, “Look, that thing you did, it was way beyond. I can’t handle it. You’re relieved of your employment.”
But maybe you say, “I wanna keep Chris here. He’s a pretty good employee and I don’t understand why he did this.” So you pull me in the office and you’re like, “Chris, I need to understand. This thing that happened and it’s really messing up the company, can you explain to me what your thinking was?” And that action will result in your desired action, even though you may be really angry and you want to take pretext number one, your end result, your desired result, would occur more by pretext two.
Brett McKay: Gotcha. So the end goal determines the pretext?
Chris Hadnagy: Yes.
Brett McKay: Okay. So you’ve set the pretext, you got that going. The next part is, in hacking human, social engineering is developing rapport with someone. And we’ve had a guest of yours, a partner of yours on our podcast, Robin Dreeke who writes and talks and trains a lot about this. How do you define rapport when it comes to communication?
Chris Hadnagy: I love Robin, by the way, and it’s his work from his very first book that I really base all of this on. Because building rapport is like building that connection between two people, allowing two people to feel comfortable with each other, finding that middle ground and allowing them to communicate in open space comfortably. When I talk about rapport in my classes, I often say things like, you have to answer four things to help build rapport. So who are you? What do you want? How long will this take? And are you a threat? If you can answer those four things by using one of the 10 principles that Robin talks about in his first book about rapport, you can build a strong relationship with even a complete stranger, that can make you become very friendly and you can get almost anything you want.
Brett McKay: So Robin talks a lot… This can take… He’s coming from the anti-terrorism perspective. And for him, he’d have to develop this rapport sometimes over years to get a target. How can you do this on the fly with somebody? Let’s say you’re just… You’re meeting someone for the first time. How do you develop that where they wanna connect with you and they wanna open up to you?
Chris Hadnagy: And let me just state something about why with Robin it would take that much longer. It’s the level of the ask is determined by the level of rapport. So if you and I just met, so we just met for the first time, and let’s say we’re in person, even though we’re not. We’re friendly, we’re having a nice chat, but we’re not at that level of rapport where I could be like, “Hey, Brett. You wanna come over and help me move all the future in my house? I need a strong back.” I can’t do that because we’re not there yet. Our rapport is not at that level. So what Robin is asking his targets to do is basically become a source for the government that’s not theirs. You need a pretty big level of rapport to make that ask. So in my accounts, my rapport generally, when I’m breaking into a building, I just need you to like me enough to let me through and not stop me for the next five minutes.
So I don’t need you to be my best friend. I don’t need you to fall in love with me. I just need slight rapport. So I generally do that through something that we call active listening, which is when you really show an interest in a person, they feel liked. And when they feel liked, they release dopamine and oxytocin. That brain soup makes them feel really compliant with the things you’re asking, and it makes them easier to trust you because no one thinks that a nice guy can do anything wrong. So if they trust you and like you, they’ll think that you’re not nefarious and that they’ll let you in.
Brett McKay: So just be friendly. Rapport is all about being friendly?
Chris Hadnagy: It is. Be friendly and be interested in the other person. See, people quickly know when you’re there just for your goal, they can quickly figure that out. And if you’re there to help others and you’re interested in them, they are more readily to ignore anything weird about you because they’re focused on that great feeling that you left with them.
Brett McKay: And how do you do this like in say a close relationship with your kid? What would rapport building look like that? Say, your kid did something wrong and you gotta talk to him about it. You’ve got the pretext. You’ve figured, okay, I’m gonna be kind, understanding dad. Now, my kid’s upset. He’s probably angry at me, he’s gonna push back. How do I break that barrier and develop some rapport between the two of us for this conversation?
Chris Hadnagy: That’s a good scenario, too. So we first may have to look at the situation and we say, okay, what is this? So let’s use my son. He did this thing. I think I tell this story in the book. I do tell the story in the book. He got into a fight at a party. And he didn’t wanna talk to us about it ’cause he was embarrassed. So the rapport building for me has to be first, “Hey, Tommy. How did it go last night? Did you have a good time?” “Oh, yeah. I did this, this and this.” “Oh, that’s great.” And you have a conversation about the things he liked. What that does, is that gets him in his mindset of, oh, I’m telling dad all about the great things, the people I hung out with, the games we played, they had this kind of music, oh, I ate this food. Now, when his mindset is in a place of comfort, I say, “So, hey. What happened between you and Stewart?” And now all of a sudden, he is less uncomfortable and he’s like, “Well, something happened bad. We got into a little scuffle.” “Oh, really? That’s the shame. Tell me what happened.” And now I don’t change my tune. As soon as he tells me, I don’t go, “What? You did what?” I still keep with that same pretext ’cause you never break pretext. And I’m like, “Oh, man. I’m sorry to hear that. What happened?”
And you become that active listener. He feels like, “Okay, dad’s actually not mad. I can open up a little more.” And if at any point during that I break pretext and start be like, “What the heck is wrong with you?” He’s gonna shut right back up and not wanna open up to me. So it’s… Once you choose that pretext, you’ve gotta stick to it. And let’s say he was completely in the wrong and punishment needs to occur, well, my goal of this conversation wasn’t discipline. My goal of that conversation was to find out facts. So let me keep my pre-text and at the end of it, I say, “You know, Collin, this sounds like a pretty bad situation. We’re gonna have to talk about what we need to do. But I can see you’re pretty emotional, why don’t we stop for now and we can talk a little bit later about how we have to handle the situation.” Now I end the conversation with rapport, with keeping my pretext. He sees I never broke that. I let the emotion pass. We come back a little bit later and say, “Okay, Collin. Thanks for talking to me about that. Now we need to talk about how we’re gonna fix this. You’ll obviously, you may have to go apologize,” and blah, blah, blah. We go through some steps, but I didn’t break the pretext of that compassionate dad and jump into a new pretext just because I felt I had to. When you do that and communication, trust, rapport, it gets built and you can have long-term effects on you, your family, your employees, stuff like that, for a very long time.
Brett McKay: Gotcha. Alright, so we’ve pretexted, we’ve built rapport, and let’s say in this conversation, we’re trying to persuade. We’ve got a child who’s staying out past curfew and we want to persuade them by not using coercion necessarily, but gently nudge them so they can start complying with the curfew. How does that look like? What are some skills that you use as a social engineer that can be used in everyday social interactions?
Chris Hadnagy: Yeah, so that’s another good scenario. So the worst time to talk to your… To get compliance from your kids is after they’ve right then done the bad thing. They’re less likely to be compliant with that. So what I would normally say is when you know you’re having a problem, your kid’s coming home past curfew, he’s done it a few times. So maybe you’re sitting there one day at the dinner table and you start a conversation, say, “Hey… ” I’ll use my kid again. Collin, he’s older than this now, but I can use a scenario when he wasn’t. “Collin, you’re like 17 now. What do you think your curfew should be? I’m just curious. What do you think… What time do most of your friends have as a curfew?” And he says, “12 AM.” “Okay, so right now, what do we have it at, again?” He’s like, he says to me, “10… ” Now, I know the answer but I am asking him to state it out loud. “What time do we have?” “10:30. That’s so early compared to my friends.”
And I’m like, “Okay. Yeah, I could understand that.” I said, “How about this? How about I raise it to 11 and if you can get here on time, for a period of time, we’ll raise it.” And he’s like, “Okay.” And I’m like, “So how long do you think you should comply with this new time in order to earn another half an hour?” I’ll say that to him. Now, I’m asking him for his opinion. “You tell me how long.” And he’ll be like, “How about one week?” And I’m like, “Well, you don’t go out every night. You only go out like on the weekends. So how about we say for three weeks. If you can be on time for three weeks, then I’ll add another half an hour.” “Okay, deal.” Now, let’s shake on it. So now he’s gonna work harder at complying to this new rule because he’s the one who came up with the three weeks, even though it was my idea, prodding him, and he’s gonna work really hard for that.
Now three weeks is gonna come. He’s like, “Dad, I did it.” “Okay, great. Now your curfew is 11:30.” Where I would ruin this is if I said, “Yeah, you did it, but I really don’t want you to be home at 11:30, ’cause I thought you were gonna fail.” I’ve just ruined all my trust with him, so you can’t do that. So if you’re gonna commit to this, you have to commit to it. So now he does it for three weeks, he gets his 11:30. Say, “Okay, Collin. I know you really want your curfew to be midnight, so how about this? Because that’s really late for me, it makes me worried. So how about we do a four-week period for this next curfew, and if in one month you’re still doing it, great. Then we’ll raise it to midnight.” He’s like, “Okay, great.” And then we make some rules up, because we know there’s gonna be mistakes.
“So, hey, if you’re out, Collin, and you think you’re gonna be late, you gotta call me way… You gotta call me before that one minute mark. Tell me what’s happened, tell me why you’re gonna be late. Just because you’re late once doesn’t mean we’re gonna deep six this deal. We may have to talk about the reason. So it can’t be, ‘Ooh, I forgot to look at my clock.’ So let’s talk about this.” And we give them options to also communicate more openly. I found that to get a lot better compliance with my kids.
Brett McKay: I think that’s for anybody. People like to feel like they have choices. If someone feels like they’re making the choice, they’re more likely to comply, which it sounds counter-intuitive. You’d think if you constrained people’s choices, they would comply but that’s not how it works.
Chris Hadnagy: It’s not, no. Because sometimes the act of non-compliance is just that they feel trapped. And when you feel trapped, your only option is to not comply. But if you give people options, then compliance generally is not what, especially your kids, is not what they’re arguing about. It’s just that you didn’t give them a choice. I tell the story in the book about when my son was young. At one point, he decided “I’m not eating breakfast anymore before school,” and it was affecting his moods and his low blood sugar and all of this at school, and the teachers were complaining and he was sneaking snacks in the middle of class. And so I kept saying, “You have to eat,” and I was doing it the wrong way. And then I came up with this idea. You know what? I’m gonna ask him before bed one night, “Okay, Collin. Tomorrow morning, what do you want? Oatmeal or eggs.” He was like, “Oatmeal.” “Great. How do you want it? I’ll make it any way you want.” Now he has a choice. “I want it with honey and brown sugar.” “Okay, great. Done.” Next morning, he gets up, there’s a bowl of oatmeal the way he wanted it. It was his choice, delivered the way he asked for it. We won. He ate oatmeal so much that, to this day, he’s now in his 20s, he hates oatmeal.
Brett McKay: And you do this, sort of giving people options in your social engineering. Like you’ll go to a desk and instead of saying, “Hey, you let me in. I’m the electrician.” It’d be like if they say, “No,” you’re like, “Oh, well, is there anything we can do? Is there something we can do to make this happen?” And you give person like the choice decision to say yes or no.
Chris Hadnagy: And a lot of times what I do is I give them a choice that both leads to me getting what I want, but they feel like they have the choice.
Brett McKay: Right. So what would be an example of this? How would that…
Chris Hadnagy: So I went into a place once where we knew the guy was on vacation. He went on Facebook, he put on Facebook he was going on vacation. He put that he was flying. He took pictures of them there, and then he said, “I’m offline until February 14th.” So we knew we had some time. So when I went into the place expecting that the gatekeeper would just fall for that, “Hey, Jack asked me to come. He said he’s on vacation here at this island. He won’t be back till the 14th, he wanted me to fix his computer.” She was like, “No, you’re not in the book. I’m not letting you in.” So now I had to come up with a choice. “Okay. Well, listen, Beth. I’ll leave, but I need you to sign this document saying you’re rejecting the appointment.” And I hand her the clipboard and she grabs it and she’s… Right before she signs it, I say, “Because I won’t be able to make it back probably until the end of March, ’cause that’s the next appointment I have open.” And she’s like, “Oh, no. If he’s having a problem with the computer, you need to come back in February when he’s back.”
And I said, “Well, I explained to Jack when he called that we had only two slots. He chose this one, the other one’s full now, so I can’t come back until March.” And she’s like, “Well, I don’t wanna sign this then.” And I’m like, I said, “Beth, come on. You understand the rules here. If I go back to my boss and say, I didn’t do this job, he’s gonna ask why. I’m gonna have to tell him that you wouldn’t let me do the job because Jack probably forgot ’cause he was so excited about going on his first vacation. So you tell me. How do you think I should handle this?” And she just stares at that paper for a full 10 seconds, which is super long. And I don’t say anything. You just gotta stay quiet, let them think. And then she huffs and she goes, “Okay, come on. Come with me, but I’m gonna go in the office first and shut some things up just for security.”
And I’m like, “Okay.” So she goes in and she shuts his closet where his whiteboard is, she shuts all his desk drawers. She turned some papers over on his desk, and then she goes, “Okay. You can go in.” And she lets me into the office and leaves. So I opened the clipboard or open the whiteboard, turn the papers over, open the desk, hack the computer, and then I leave. But it was her choice that I gave her that allowed me to win that.
Brett McKay: Alright. So yeah, but in this example, you wouldn’t want to lie to your kid, saying…
Chris Hadnagy: Oh no.
Brett McKay: You’re not doing… But it’s the underlying principle is what you’re trying to get across with this, give people choices.
Chris Hadnagy: With your kid, it’s kind of like what I did with the oatmeal. With my kid, both of those choices were good, both of those choices got what I wanted, which was him eating some food in the morning so he didn’t have a problem in school. And all I did was allow him to make the choice of which one of those options he wants. So as long as he makes one of those two choices, in essence, I win, but he made the… He had the options to choose.
Brett McKay: In the book, in this chapter about influence, you make a distinction between influence and manipulation. I think the distinction is this, is that manipulation is that you’re often using emotions, like strong emotions to get people to do something. So it’s usually fear… Fear’s the big one. So if you ever see or find yourself resorting to that, you’re no longer influencing. You are manipulating.
Chris Hadnagy: Yeah, and you take away the power of decision from the person. Because if you’re bringing fear… Like if I went into my son’s room in that same example, and I went, “”Listen. If you don’t eat breakfast tomorrow, you’re grounded from TV, iPad, electronics, video games for a month. And every day you don’t eat, you’re getting another month of grounding.” He may comply, but it’s not because he made a choice or he sees the value in it, he’s only gonna do it because of fear of punishment. So I got compliance but it’s not the way to do it. By getting him to comply with options and him making the choice, I influenced him to make a decision now he’s happy to follow. And not only that, to go on with that story, something I didn’t put in the book, there was a few times where I overslept and he would go down and make his own oatmeal, ’cause that was his choice. He had committed to it in his mind. He committed that this was the thing he was gonna eat for breakfast, so he made his own oatmeal. And that was winning because he made the choice he did, he wasn’t manipulated. It wasn’t out of fear, it wasn’t out of punishment, so it was influenced to make him have that choice.
Brett McKay: And I think that’s a good takeaway to avoid being manipulated, is if you are in a conversation and you are suddenly feeling uncomfortable, a lot of emotions, you gotta notice that. Notice that, and it’s probably a red flag that you’re being manipulated right now and you should pay more attention.
Chris Hadnagy: To kind of the play off the name of your podcast, to me it doesn’t feel too manly to be a manipulator, more power… I always ask people when I’m teaching to think of someone who they consider truly humble. And when they think of that person, whoever that person is, I say give me one or two words that describe how you feel when you hang out with that person. If your listeners are playing along, they probably have a few words in their mind, and I usually get words like empowered, strong, validated, complemented, happy. Now, doesn’t that sound awesome? If you can leave people feeling that way, that’s way more powerful than empowering yourself by manipulating others.
Brett McKay: So an important part of social hacking is you’re trying to get people to open up to you and divulge information they otherwise wouldn’t divulge. And this is called elicitation, correct?
Chris Hadnagy: Yes.
Brett McKay: So in the phishing scam world, elicitation would be getting people to say their pin number, credit card number, social security numbers, etcetera. What does this look like if you’re trying to just talk to a person, someone in an everyday relationship?
Chris Hadnagy: Sometimes I wanna find out information about, let’s say an employee. Why were they in a bad mood this morning? So and so came to work, and man, she was in a really bad mood and she was snappy with people. She’s normally really jovial. So again, my pretext, I can go up to her and say, “Hey, what’s wrong with you? You’re kind of being snappy today.” That would be one way. I may embarrass here or call her out, make her feel bad, or I can have a conversation with her. An elicitation conversation may be something like… We’re at the coffee pot, we’re getting coffee at the same time. And I’m like, “Oh, man. I really need this. This is like my third cup. I had a rough night. I woke up on the wrong side of the bed this morning, so if I say anything stupid, please just forgive me.” And that conversation may elicit her now to say, “Yeah. Me too, man. Got in a fight with my husband this morning. Just put me in a bad mood. On the way here, I hit a squirrel. You know how much I hate killing animals, just kinda wrecked my whole day, just in a total bad mood.” I got the answer I wanted, but I didn’t have to ask the question. That’s elicitation.
Brett McKay: Right. To get a secret, share a secret.
Chris Hadnagy: Yeah, yeah. Quid pro quo, that’s what they call it. So you give a little bit, you get a little bit. And in that time, she may later on realize I was asking this, but she doesn’t feel violated or put on the spot because I didn’t come up to her and say, “Hey, what’s up with the attitude?” All I did was have a conversation and I told her… Now, again, if that didn’t happen to you, don’t make up a lie. Don’t be like, “Yeah, on the way here this morning, I hit a dog. Really makes me sad. It ruined my day. You know how much I hate killing animals, too,” ’cause you know that about her. That would be a horrible way if she finds out that never happened, and then you’ve ruined all your trust. So, yeah, you can’t. You have to make sure it’s truthful, make sure that what you’re saying is honest, because if you ever get caught in that lie, they’re going to… You’re gonna ruin rapport.
Brett McKay: Well, besides through the quid pro quo, are there any other elicitation techniques that you think are useful in everyday social interactions?
Chris Hadnagy: What I love… One of my favorite ones, there’s a few that I mentioned in the book, but one of my favorite ones is called deliberate false statement. And that sounds opposite of what I just said about being truthful, but let me tell you how it can be used. So you take a statement that you know isn’t truthful… Now I’m not encouraging you to lie. So I’ll give you an example of how this may work. Maybe you and I are in a conversation and you say something like, “Oh, yeah. I’ve been running this podcast for X amount of years.” And I go, “Really? Wow, you’ve been doing podcasts for that long?” And now I’m faking the surprise, but I’m doing it in a way where I’m not just like teasing you or mocking you. And now what that does to you is, it shows you I’m interested and you keep talking. You’ll be like, “Oh, yeah. I remember my early days, this and this and this.” And then I go, “So I don’t know… Like what is that? Like you must have been… You’ve been doing it for 10 years. You must have been what, 19 when you started?” Deliberate false statement.
And you’re like, “No, man. I started when I was like 24.” “Oh, okay.” Now I know you’ve been doing it for 10 years. You’re 24, you’re 34 years old. Now, I can figure out what year you were born. Like, “Oh, 34. Oh, man. Okay, so you’re an ’80s baby. Wow, that’s kinda cool. Man, the ’80s were a crazy time, huh? I don’t know about you, but for me, ’80s, summer time, out of school, that was my favorite time.” And now we start talking about things you like and I may find out the month you were born. Here’s a conversation where in just a few sentences, with a few principles, I know something about your work, I know how long you’ve been podcasting, how old you are, the year you were born, the month you were born, your hobbies during those times. And I don’t have to use any of that. I just now have all this information on this person that helps me build a relationship.
Brett McKay: Alright, so feigned interest. I mean it’s not feigned, you’d be interested and just sort of say things like, “Oh, wow,” and people are just gonna open up to correct you.
Chris Hadnagy: Yeah, and the reason they call it feigned is because you’re being surprised and you may not be. But you don’t wanna go overboard like, “Oh, my God! You’ve been… What! That’s amazing!” That’s too much, right? So you don’t do that, but you go, “Really? 10 years? Wow, dude, that’s a long time to be… You were podcasting when it wasn’t even popular.” And that is… That’s not a fake statement, but maybe the surprise is a little bit, but I’m not being superficial. I’m just doing that because I want you to talk more about it.
Brett McKay: Gotcha. And this elicitation, this is all part of… It’s a virtuous cycle, all this stuff is going on. It’s not like a ladder, like you do this, this, this… It’s going on all at once. You might be doing some elicitation, then you’re gonna go back to pretexting, then you’re gonna go back to rapport building and then go back to influencing. And so you have kind of to see this as sort of like a fluid, dynamic interaction and that elicitation can help you, one, develop more rapport and two, figure out what you can do or say to help be more influential.
Chris Hadnagy: Exactly right. I love the way you put that, very fluid, because you may have to revisit your pretext to make sure you’re staying true to it. And when I hit tier one rapport, because elicitation is going so well, I might wanna take that to the next tier of rapport.
Brett McKay: And a point you make in the book, and I think a lot of people think this might be weird, but it can be really useful is, when you’re having a conversation or you’re going to have a conversation with somebody, take some time before that conversation and outline it. You don’t have to do pencil and paper but you make this argument that before any big conversation, or even a small conversation, you should have a rough idea of, okay, what’s the pre-text, what’s your goal, how are you gonna build rapport with this person based on their personality, and that can help the conversation go a lot more smoothly.
Chris Hadnagy: I put this thing out… So if you go to humanhackingbook.com and you sign up for the resources page, I actually put a worksheet on there on how you can do that. Because I had so many people asking questions like, “How do I outline just a conversation?” ‘Cause I love the way you put it. You’re not outlining every word, you’re not writing a script, you’re not sitting there saying, “Okay, then say this.” That’s impossible to do. But what you do is you can outline your goals, your pretexts, how you’re gonna apply these principles, what methods you wanna use. And I have a worksheet on there that can help you do that and I even give you a sample worksheet on one that I worked up to have a hard conversation with my daughter. So you can work these things out. And if you have that kind of a goal set before a conversation, there’s a greater likelihood that it’s gonna go the way you want and you’re gonna be able to accomplish your goal because you have that plan.
Brett McKay: And I imagine as you do this, you can start off doing this very deliberately, but as you do this stuff, practice this stuff over and over again, you can start doing it on the fly. You won’t need to do that.
Chris Hadnagy: Yeah. Yeah, I don’t fill out sheets now for every time I do this, because I’ve been doing this for so long. When I have, let’s say an employee problem, let’s use that. I’ll go, “Okay… ” She’ll laugh when she hears this. I’ll use Maxie as an example. So I’ll go and look at Maxie’s DISC profile that I have, and I’m gonna go, “Okay, she communicates this way. I have to get her to do this. What’s my best way of doing that? What’s the principles I should use? What’s the timing I should approach her? I know she gets nervous if I say, ‘Hey, can we just have a conversation?’ She always thinks that’s something bad. So let me approach it this way.” And I make a little plan in my head of the best way to bring this up, and then I go and execute that. I don’t have to write it all down because I’ve been doing it for so long. It becomes second nature, and that will happen for anyone. You do this a few times, it becomes second nature and you’ll just… You’ll find you’re doing it without even thinking.
Brett McKay: Well, Chris has been a great conversation. Where can people go to learn more about the book and the rest of your work?
Chris Hadnagy: So if they want more on the book, they can go to a humanhackingbook.com, all the areas you can buy it are there in addition to that resources page, which has so many details. We have a conference coming up, which is all about this. It’s a virtual conference, humanhackingconference.com, March 11-13, which has some of the world’s greatest minds and speakers. Robin Dreeke will be there, and Joe Navarro, some others that will be doing some training on how we can improve ourselves, like hack ourselves.
Brett McKay: Yeah. Well, Chris Hadnagy, thanks for your time. It’s been a pleasure.
Chris Hadnagy: Thank you.
Brett McKay: My guest today was Chris Hadnagy. He’s the author of the book, Human Hacking. It’s available on amazon.com and book stores everywhere. You can find out more information about the book at his website, humanhackingbook.com, also check out our show notes at aom.is/humanhacking where you can find links to resources, where you can delve deeper into this topic.
Well, that wraps up another edition of The AOM podcast. Check out our website at artofmanliness.com where you can find our podcast archives, thousands of articles, written reviews about pretty much anything you think of. And if you’d like to enjoy ad-free episodes of the AOM podcast, you can do so on Stitcher Premium. Head over to stitcherpremium.com, sign up, use code MANLINESS at check out for a free month trial. Once you’ve signed up, download the Stitcher app on Android or iOS, and you can start enjoying ad-free episodes of the AOM podcast. And if you haven’t done so already, I’d appreciate if you take one minute to give us a review on Apple podcast or Stitcher, helps out a lot. If you’ve done that already, thank you. Please consider sharing the show with a friend or family member who you think would get something out of it. As always, thank you for the continued support. Until next time, this is Brett McKay reminding you, not only listen to our podcast, but put what you’ve heard into action.
Submitted by: Andrew Trahan in Lafayette, Louisiana, United States
