7 Social Engineering Tactics Explained | AP Cybersecurity

AP Cybersecurity Topics › Social Engineering Tactics

Unit 2 • Topic 2.1 • Cyber Foundations

The 7 Social Engineering Tactics (Authority, Scarcity, Urgency & More)

Topic 2.1 expands social engineering into a full set of psychological tactics adversaries use to manipulate targets: pretexting, authority, intimidation, consensus, scarcity, familiarity, and urgency. The exam asks you to identify which tactic a scenario uses.

The seven tactics
Why so many tactics matter
Real-world example
Key terms
Match it up
Check for Understanding
FAQ

7named tactics (EK 2.1.A)

1goal: manipulate a target

Identifythe tactic in a scenario

Three of the seven tactics; each creates a different kind of pressure to comply.

The seven tactics

Each tactic pulls a different psychological lever. Pretexting invents a believable reason to make contact. Authority impersonates someone with power or claims to relay their instructions. Intimidation states negative consequences if demands are not met. Consensus claims everyone else is already doing the action.

Scarcity creates a sense of limited availability. Familiarity pretends to be or know someone close to the target to build trust. Urgency sets a deadline that forces quick action.

Scenario

An email says: 'Only 3 spots left, register in the next hour.' Which tactics are at work?

Reveal answer

Scarcity (limited spots) and urgency (one-hour deadline). Both pressure the target to act before thinking, just through different levers.

Exam tip

Match the lever to the tactic: power = authority, threat = intimidation, deadline = urgency, limited supply = scarcity, everyone-is-doing-it = consensus, a trusted persona = familiarity, a fake backstory = pretexting.

Why so many tactics matter

Real attacks combine tactics to be more convincing. A message might use authority (posing as the CEO) plus urgency (a same-day wire) to maximize pressure.

Recognizing the specific lever helps you defend: once you name the manipulation, the request loses its power and you can verify through a trusted channel.

Scenario

'This is the IT director. Everyone on your team has already updated their password at this link, please do yours now.' Name the tactics.

Reveal answer

Authority (IT director), consensus (everyone already did it), and urgency (now). Verify through a known channel before clicking anything.

Real-world example

Authority in the 2020 Twitter breach

Attackers posed as internal IT, using authority to pressure employees into handing over access. Naming the tactic, authority paired with urgency, is what lets a target step back and verify.

Identify the lever, then verify through a known channel.

Key Terms

Pretexting	Inventing a believable reason to contact a target.
Authority	Impersonating someone with power over the target.
Consensus	Claiming everyone else is already doing the action.
Scarcity	Creating a sense of limited availability.
Familiarity	Pretending to be or know someone close to the target.

Match It Up

Tap a term, then tap its definition. Correct pairs lock in green.

Term

Definition

All matched. Nice work.

Common Mistakes

Confusing consensus with authority

Consensus says everyone is doing it; authority claims power or position. Different levers.

Treating scarcity and urgency as identical

Scarcity is limited supply; urgency is a deadline. They often appear together but are distinct.

Missing familiarity

Pretending to know someone close to the target is its own tactic, not just generic trust.

Looking for only one tactic

Strong attacks stack several. Identify each lever present.

Check for Understanding

Predict your answer before you tap. Click a choice to check it and read why.

Question 1

An adversary claims to be the new VP and orders an employee to bypass a policy. Which tactic is this?

B. Impersonating someone with power over the target is authority.

Question 2

'Limited time offer, only a few licenses remain.' Which tactic?

A. Creating a sense of limited availability is scarcity.

Question 3

Which tactics are named in the framework? I. Consensus. II. Familiarity. III. Encryption.

B. Consensus and familiarity are social engineering tactics. Encryption is a control, not a tactic.

Question 4 Predict first

An attacker invents a believable backstory to start a conversation with a target. This is:

C. Creating a believable reason to contact a target is pretexting.

Question 5

'Everyone in your department already approved this, you are the last one.' Which tactic?

A. Claiming everyone else is already doing the action is consensus (social proof).

Question 6 Predict first

A caller pretends to be the target's coworker's friend to build trust. Which tactic?

D. Pretending to be or know someone close to the target is familiarity.

Frequently Asked Questions

Seven: pretexting, authority, intimidation, consensus, scarcity, familiarity, and urgency. The exam asks you to identify which a scenario uses.

Scarcity is a sense of limited availability (only a few left). Urgency is a deadline (act in the next hour). They often appear together.

Pretexting is inventing a believable reason or backstory to contact a target and gain their trust before making a request.

← PreviousAI in Cyber Defense Next →Types of Threat Actors

Keep studying

All Topics Unit 2 Study Guide Practice Questions

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]