Theory X vs Theory Y in social engineering

Question

Theory X and Theory Y are two models of human motivation, often used when discussing people-management in business. In short, Theory X postulates people are lazy, will avoid work, and require incentives, whereas Theory Y postulates that people are ambitious, motivated and creative.

The consensus in general management is that Theory X is more counter-productive, and that Theory Y is a more accurate depiction of human behaviour. Do the same conclusions hold for social engineering?

I propose the following:

• Theory X of social engineering is that people are likely to conform to your requests when presented with threats, scare tactics and authority. An example of this is the recent Microsoft call-centre scam.
• Theory Y of social engineering is that people are likely to conform to your requests when presented with opportunities, positive reinforcement, and emotional appeals. An example of this is the Nigerian 419 scam.

Is there any evidence that one theory is more accurate than the other? Are there any papers that analyse the effectiveness of these tactics?

Answer 1

I'd say you're pushing Theory X and Theory Y too far away from their original position. The original posit of the theories relates to a relationship between people and authority. The people are in a system in which the manager has a significant degree of control over employment conditions and outcomes.

The social engineering concepts and strategies run counter to the idea that the social engineer has a position of direct authority over his victims. Very much the opposite - the social engineer is getting something out of the victim that the social engineer has no right, authority or need to have. Also, since the purpose is fraudulent, I'm not sure that you can make the same assumptions about self-motivation playing the same role in the relationship. The comparison of Theory X vs. Y is typically selfishness vs. self-motivation.

In many cases, social engineering can probably work either way. For example - I'd see Phishing working either way - in a Theory X situation, the victim might be motivated to respond to phishing queries because he wants to avoid punishment or reap monetary reward, in a Theory Y situation the victim might be working towards some shared goal that provides intrinsic motivation. Either way, the social engineering side is that the victim doesn't know that the attacker's purposes run counter to the victim's best-interest so the nature of his motivation is not nearly so important.

Answer 2

I fundamentally disagree with the theory X/theory Y models as they are way too cut and dried. The simple truth is that on any given day people can be motivated by different things. One one day a person may be ambitious and ready to please while another day the same person may be in work avoidance mode. Or that person may working 2 projects and be ambitious for one and lazy on the other because they perceive that one is run by a heavy-hitter and the other is a waste of time.

From a social engineering perspective your Theory X and Theory Y may work on the same person, or neither may work. It's rare that you get someone who is motivated by threats but not by gain. It's too simplistic I'm afraid.

Answer 3

I would tend to say that the X/Y theory is not very relevant to scamming. Let me quote an expert at understanding people, namely Terry Pratchett:

There is a saying "You can't fool an honest man" which is much quoted by people who make a profitable living by fooling honest men. Moist never knowingly tried it, anyway. If you did fool an honest man, he tended to complain to the local Watch, and these days they were harder to buy off. Fooling dishonest men was a lot safer and, somehow, more sporting. And, of course, there were so many more of them. You hardly had to aim.

(from the novel "Going Postal")

This is a concise expression of how Nigerian scams operate: they turn the victim into an accomplice. They begin by expressing a need to move around a substantial amount of money from one country to another, discreetly and without fuss. The prospective victim is lured into a scheme which the said victim fuzzily believes to be somewhat dishonest at some point. The scammers are very careful never to say it plainly, of course. This is part of the act, the victim feeling all the more witty and self-confident by having deduced by himself that some foul play was at hand. Self-confidence, and being uprooted from his usual, comfortable life of basic honesty, make the victim more prone to accept outrageous claims and irrational twists.

So I would say that Nigerian scams work because people are greedy, excitable and trespassers of moral boundaries. They crave the thrill of dabbling in crime and this makes them forget all cautiousness.

On the other hand, the "Microsoft call-centre scam" relies on people being timid, anxious and natural followers. Most people utterly fear having to assume the consequences of their choices. So, in times of disquiet due to a (perceived) threat, especially one involving guilt (in the scam, the first thing that the scammer says is "there is a problem coming from your computer"(*)), they will be ready to follow to the letter the nearest authority figure, which the scammer tries hard to incarnate.

As Benjamin Franklin, another smart guy good at dealing with people, famously said:

Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety.

and while old Benji tries to put it under a disapproving moral light, he mechanically stresses the point, which is that people will give up quite a lot to purchase a little temporary safety, even if they have to purchase it from the very man who plunged them into danger. That's the Microsoft call centre scam all right: the victim complies to the whims of the scammer because they try to buy his indulgence (for an imaginary crime !) by their subservience.

^{(*) I have been phone-called by these scammers every fortnight or so, since at least last year. As a joke, it grows old.}