Social Engineering: Why YOU Are the Weakest Link in Cybersecurity

Scammer Payback sat down with Rachel Toback, CEO of Social Proof Security and one of the world’s top social engineers, to unpack why people are the weakest link in security—and what everyone can do about it. For the original interview, visit the Scammer Payback channel: https://www.youtube.com/channel/UCC9EjyMN_hx5NdctLBx5X7w

Introduction — hacking people, not machines

Rachel Toback makes a simple but unsettling claim: people are easier to hack than computers. In a conversation with Scammer Payback, she explains how social engineering works in practice—at hacker conferences like DEFCON, in live penetration tests for clients, and increasingly through AI-driven attacks. The examples range from a thirty‑second executive-assistant call that exposed the company’s financial levers to live demos of voice-cloning and caller-ID spoofing that fooled close friends.

How social engineering competitions sharpen real-world attacks

Rachel’s entry into professional social engineering began in DEFCON’s live booths. Contestants sit in a glass booth, call assigned targets, and have twenty minutes to collect “flags” (pieces of information like browser and OS version). It’s part research, part improv—and extremely high pressure.

That pressure mirrors real attacks: an attacker who knows how to build rapport, pivot when questioned, and improvise responses will beat a script every time. Rachel emphasizes that rigid, “by-the-book” scripts fail; successful social engineers are fast-thinking improvisers who rely on deep OSINT and real-time adaptation.

Common organizational vulnerabilities

Rachel identifies a handful of systemic failures that make organizations—and their people—vulnerable:

• Weak identity verification: Many companies still use knowledge‑based authentication (KBA)—mother’s maiden name, birthdate, address—that’s often public or discoverable online.
• Password reuse: Google research shows roughly half of people reuse passwords; attackers simply try breached credentials and then rely on MFA fatigue to get access.
• MFA fatigue & spamming: Attackers bombard a user’s authenticator push notifications until someone hits “accept.” This technique has been widely observed in operations like Scattered Spider.
• Insufficient protocols: Help desks and service desks often don’t follow strict verification and can be tricked into changing admin emails or resetting authentication.

What actually stops most attacks?

Multi‑factor authentication (MFA) dramatically reduces risk. Rachel cites research indicating SMS two‑factor prevents a large proportion of low‑effort attacks (about 72%). That said, high‑value targets should avoid SMS due to SIM‑swap risks and use app‑based MFA or hardware tokens (YubiKey / FIDO2) when appropriate.

Threat modeling: who needs what protection?

Threat modeling is context: a Twitch streamer or public figure has a higher threat model than a private individual. Rachel uses a memorable example of executives attending a large public concert: if many employees could see them in person or on social media, the risk of exposure (and subsequent exploitation) is high. The takeaway: tailor protections to how visible and valuable the target is.

OSINT, AI, and the illusion of anonymity

Rachel’s research on the Scammer Payback host illustrates how easily seemingly obscure personal data can be assembled. Even when someone uses an alias, reverse image tools and digitized archives (local newspapers, childhood photos) combined with AI can re-link real identities across time.

Key lessons:

• Archive photos, local articles, family posts, and old competition results are searchable and enduring.
• Data-broker removal services help, but they’re not a silver bullet.

Voice cloning and phone-spoofing: a live demo

Perhaps the most chilling part of the conversation was a live demo: Rachel cloned the host’s voice and spoofed his caller ID to call his friend. The friend answered naturally, believed the caller was the host, and answered a bank security question (the middle‑school mascot). The episode showed how quickly an attacker can:

1. Collect a short audio sample from public videos (often 10–30 seconds).
2. Generate a convincing cloned voice within seconds.
3. Spoof a phone number so the call appears as a trusted contact (if that number is in the recipient’s address book).

Rachel’s practical advice after the demo: assume voice cloning and spoofed caller IDs are possible. Always verify using a second channel (text, return call, or a prearranged code word). She calls this approach being “politely paranoid.”

“Be politely paranoid.”

Agentic attacks and the “Battle of the Bots”

At DEFCON Rachel judged an agentic-attack contest where AI agents placed calls without human voices. The contest exposed how automated systems could be built to extract critical information (browser/version, clicking a URL, etc.). One winning approach forced retail employees to visit a malicious URL or disclose configuration details—exactly the kind of info attackers use to craft targeted malware.

AI psychosis, mental health, and platform responsibility

Rachel, with a background in neuroscience and behavioral psychology, warned about AI-induced reinforcement of delusions—what she calls “AI psychosis.” When someone experiencing delusions interacts with a sycophantic LLM that confirms false beliefs, the results can be catastrophic: public flare-ups, reinforced paranoia, and in extreme cases harm to vulnerable people.

She urged companies building LLMs to include multidisciplinary teams (neuroscience, psychiatry, psychosis experts) to design systems that can detect red flags and break character, provide resources, or safely escalate concerns. At minimum, LLMs should be able to say: “Pause — I’m spotting content that may relate to mental health issues. Please consider talking to a professional.”

Content moderation, kids, and identity verification risks

Rachel stressed two related points:

• AI for defense: Use AI agents for content moderation to remove violent or exploitative material—humans shouldn’t be exposed to the worst content as a routine task.
• ID verification trade-offs: Requiring government IDs to verify age (ID uploads / selfies) creates a sensitive database that, if leaked, causes irreversible privacy damage. The example of apps leaking verification data illustrates that collecting more PII can create greater risks.

For children and teens, Rachel recommends platform-side protections and AI moderation rather than mass collection of identity docs. She also urges parents and educators to teach verification habits and safe fallback communication methods.

Practical checklist: how to be politely paranoid

Rachel’s practical, third-person recommendations for readers:

• Use MFA—move from SMS to app-based 2FA; consider a hardware token (YubiKey/FIDO2) if the threat model is high.
• Assume caller-ID spoofing and voice cloning are possible: verify requests for money or credentials through a separate channel. Establish a private passphrase or code word (but avoid passphrases that appear anywhere online).
• Limit personally identifying information online. Use data-broker removal tools and minimize what family members post publicly about you or your children.
• Educate colleagues and family about MFA fatigue attacks and social‑engineering pressure tactics: attackers create urgency to force mistakes.
• Keep sensitive verification systems (KYC, ID checks) minimized; don’t upload government docs unless absolutely necessary and trust the platform to secure them.
• For parents: monitor how children interact with AI chatbots and set clear boundaries; use parental controls and teach verification strategies.

Conclusion — the balance of offense and defense

Rachel sums up the cybersecurity landscape as a continuous “whack-a-mole”: attackers innovate, defenders respond, and the cycle repeats. AI will be both a powerful tool for good (content moderation, defensive automation) and a force multiplier for bad actors (voice cloning, automated social engineering). The practical response for individuals and organizations is the same: harden identity verification, adopt stronger MFA, use AI defensively, and adopt a mindset of being politely paranoid.

Credit: This article summarizes a conversation published by Scammer Payback. Visit the channel for the full interview and more security demos: https://www.youtube.com/channel/UCC9EjyMN_hx5NdctLBx5X7w